SECURITY & PRIVACY
Patient information deserves a plain explanation of where it goes and who can use it. Choose a part of the picture to read how it is handled.
A patient signs in with a one-time code sent to their email. There is no password to forget or reuse. They see their own pathway and nothing else, and their session ends after a period of inactivity.
A patient’s entries belong to their practice’s record; the practice answers access and correction requests.
Owners, clinicians and staff each have defined permissions, enforced by the application. Clinician sign-in requires a second factor. The actions that matter are written to an audit trail the practice owner can read.
Roles limit what a person can do; they do not decide what a practice should review or when.
Every practice’s records are separated from every other’s by the database itself, not only by the application. Data is encrypted in transit and at rest, and the database is never reachable from the internet. The application and its database run on AWS in Sydney.
Practice separation is tested as code on every change.
Drafting receives the practice documents you select. The assistant can receive structured patient information under temporary references, never a patient’s name, along with what you type. Processing stays in Australia, and a practice owner can turn AI off. Your content is not used to train AI models, and request logging at the AI service is switched off.
Temporary references do not make health information anonymous. Keep patient details out of uploaded documents and prompts.
Stripe handles the practice’s subscription and receives the practice’s business details and aggregate counts. It never receives a patient’s name or clinical content, and billing never cuts a patient off mid-recovery.
Founding terms are stated before a practice is invited to sign up.
Email carries invitations, sign-in codes and reminders a practice turns on. An optional daily digest to the practice holds counts and a link to the portal, never a patient’s name or reading.
Nothing clinical is sent by email, and a check-in never triggers an urgent message to anyone.
A patient signs in with a one-time code sent to their email. There is no password to forget or reuse. They see their own pathway and nothing else, and their session ends after a period of inactivity.
A patient’s entries belong to their practice’s record; the practice answers access and correction requests.
Owners, clinicians and staff each have defined permissions, enforced by the application. Clinician sign-in requires a second factor. The actions that matter are written to an audit trail the practice owner can read.
Roles limit what a person can do; they do not decide what a practice should review or when.
Every practice’s records are separated from every other’s by the database itself, not only by the application. Data is encrypted in transit and at rest, and the database is never reachable from the internet. The application and its database run on AWS in Sydney.
Practice separation is tested as code on every change.
Drafting receives the practice documents you select. The assistant can receive structured patient information under temporary references, never a patient’s name, along with what you type. Processing stays in Australia, and a practice owner can turn AI off. Your content is not used to train AI models, and request logging at the AI service is switched off.
Temporary references do not make health information anonymous. Keep patient details out of uploaded documents and prompts.
Stripe handles the practice’s subscription and receives the practice’s business details and aggregate counts. It never receives a patient’s name or clinical content, and billing never cuts a patient off mid-recovery.
Founding terms are stated before a practice is invited to sign up.
Email carries invitations, sign-in codes and reminders a practice turns on. An optional daily digest to the practice holds counts and a link to the portal, never a patient’s name or reading.
Nothing clinical is sent by email, and a check-in never triggers an urgent message to anyone.
WHO CAN DO WHAT
Access is scoped to the practice, roles decide what each person may do, and the important actions are recorded where the practice owner can read them. An administrator’s role is never a reason to see a patient’s information: the people who operate rycova itself cannot read a patient’s record at all.
Practice separation and the role rules are tested as code on every change.
The website notice covers visitors and the waitlist. The patient product has its own notice explaining health information, the practice’s responsibilities, AI processing and what happens to records over time; a practice receives it when it joins and gives it to patients.
FOUNDING PRACTICES
Early access opens in waves, with founding pricing explained before you sign anything. Joining the waitlist creates neither an account nor a subscription.
Join the waitlist