Secure sessions
HTTP-only cookies, CSRF protection on state-changing requests, hashed passwords, and rotating refresh tokens.
Trust is an operating requirement
Bewelo is built as multi-tenant practice software with isolation, careful sessions, and private file handling, not as an afterthought.
Designed for multi-tenant care software
Isolation, sessions, and private storage are part of how Bewelo is built — not bolted on later for a marketing checklist.
Tenant isolation
Practice data is tenant-scoped with database row-level security so one practice does not see another’s records.
Private files
Documents live in private object storage with short-lived, authorized download links, not public buckets.
Audit & evidence
Sensitive actions are audited so practices and platform operators can reconstruct what happened without dumping full record snapshots into logs.
Compliance readiness without certification claims
Bewelo ships production compliance workflows so practices can run retention, access, and erasure inside the product. We do not certify your practice under HIPAA, PIPEDA, GDPR, or any other law — jurisdiction templates are examples until your legal team approves and activates them.
Tooling, not a legal verdict
Policy controls, approval gates, audit evidence, and deletion ledgers are built in. Meeting a specific regulation still depends on how your practice configures policies, contracts, and day-to-day operations.
US and Canada policy examples
Retention templates target country and province or state levels for clinical notes and client profiles, with placeholders informed by common U.S. medical-record retention and Canadian privacy (PIPEDA and provincial) expectations. They ship unapproved and cannot authorize disposal until counsel approves them.
Data subject rights workflows
Export, correction, anonymization, deletion, and account-closure requests are tracked in-product with status, legal holds, and retention checks — the operational layer many privacy regimes expect practices to maintain.
Compliance workflows in the product
Retention, holds, exports, subject requests, and offboarding are built into Bewelo, with permissions that decide who can run each step.
Retention policies
Policies can target country, region, and record type (notes, forms, appointments, files, billing, and more), with retention windows and disposal methods that stay versioned and approval-gated.
Legal holds
Place or release holds on subjects so disposal workflows pause while a matter is open, without inventing a side path around the product.
Encrypted exports
Request client- or practice-scoped packages as encrypted archives with manifests and checksums, stored privately and time-limited for download.
Data subject requests
Track export, correction, anonymization, deletion, and account-closure style requests against a client so the practice can work the queue with clear status.
Practice offboarding
Leaving Bewelo follows a controlled path: export, freeze writes, revoke sessions, stop billing cues, and preserve audit evidence before irreversible deletion.
Permissioned operators
Compliance reads and writes are gated by tenant and platform roles, so retention execution and tenant deletion stay explicit rather than ambient admin power.
What this page covers (and what it does not)
This is a product overview of security and compliance tooling, not a legal certification claim, guaranteed compliance outcome, or substitute for counsel. Bewelo is not HIPAA-, PIPEDA-, or GDPR-certified; jurisdiction policy templates remain unapproved examples until your legal review activates them. For security or compliance questions about your practice, contact us and we will point you to the right next step.
AI integration is coming soon
When AI features arrive, they will respect the same tenant boundaries, access controls, and audit expectations as the rest of Bewelo.
Ready to run your practice on your brand?
Start a free trial, register your practice, and invite your care team when you are ready.