Patient data, protected at every step.
Chairlytics reads your numbers from Open Dental, encrypts them at your office, and shows each person only what their job needs. Office Chat, our add-on, never leaves your office at all. Here is exactly how it works.
- Read-only
- Its own Open Dental login that can only read the tables Chairlytics uses. It cannot change your records.
- Encrypted twice
- AES-256 at your office before it leaves, inside HTTPS on the way, and again at rest with a key that belongs to your practice alone.
- BAAs, both ways
- We sign a Business Associate Agreement with your practice, and our server host, Vultr, has signed one with us.
- The right eyes only
- Two-factor sign-in, a view for each role, and patient names hidden by default.
Analytics · in the cloud
How your practice connects
One small program on the Open Dental server. Nothing to install on the office PCs, and no firewall changes: the program only sends data out.
- 1 · Your office
Open Dental server
The Chairlytics Agent reads only what the dashboards need and encrypts it before it leaves.
- 2 · Chairlytics
Our server in Dallas, Texas
A dedicated server at Vultr's Dallas data center, under a signed BAA. Each practice's data is stored under its own key.
- 3 · Your team
Browser, phone and inbox
Dashboards in the browser and on the phone. Emails and texts carry practice totals only.
What we keep, and how
- What is kept for your practice
- The Open Dental figures the dashboards are built from: appointments, production, collections, treatment plans, recall and balances. Plus your goals, settings and team accounts. All of it is encrypted with a key that belongs to your practice.
- Where it runs
- On our own server at Vultr's Dallas data center in the United States, under a Business Associate Agreement with Vultr. Your data is never sold, and is used only for your practice's dashboards.
- Who can read it
- Only the people your practice invites. Owners, managers, providers, billing and front desk each see what their job needs, with two-factor sign-in and automatic sign-out after 15 minutes without activity.
- What email and texts carry
- Totals only, such as production, pace and open chair hours. Never patient names or details, so a forwarded email or a lost phone exposes nothing about a patient.
What we run for you
Updates
New versions roll back by themselves if they fail a health check. Updates to the office program are digitally signed by us and checked before they install.
Backups
Encrypted backups every night and before every update, on top of Vultr's whole-server backups. Each backup is also copied every day to a second provider (Wasabi), in a separate data center, under a signed BAA. Downloaded copies are locked with a separate passphrase.
A record of every look
A tamper-evident audit trail of sign-ins, changes and every view of patient-level data: who, when and from where.
Office Chat · in your office Add-on
Office Chat never leaves your office.
Messages, files and calls for help run on your own practice server and travel only across your office network. Chairlytics sees how many messages were sent, never what they say.
- Office PCs
Front desk, operatories, doctors
Each PC is set up once with a one-time code, and each person signs in with a PIN.
- Your practice server
Where every message lives
Messages and files are stored here, encrypted with your practice's own key.
- Chairlytics
Never sees a message
Only how many messages were sent, so you can manage people and rooms from the admin page.
On your own server
The chat server runs inside the Chairlytics Agent on your practice server. No chat data goes to the internet.
Only your PCs
A PC joins with a one-time setup code that works only inside the office, and trusts your server's own certificate.
Encrypted
HTTPS across the office network, and AES-256 at rest for messages, file names and files.
PIN sign-in, auto-lock
Each person signs in with their own PIN, and the screen locks after a few idle minutes. Messages are kept one year by default, or anywhere from 30 days to 7 years.
What we do not claim
Straight answers, because your compliance officer will ask.
- No one is "HIPAA certified." No government agency certifies software or companies for HIPAA. We build Chairlytics to the HIPAA Security Rule and sign a BAA, and we say no more than that.
- Software alone cannot make a practice compliant. Your practice still needs its own policies, training and risk assessment. We are happy to answer questions for it.
- SOC 2 is in progress. We are working toward a SOC 2 audit. Until the report is issued, we do not claim one, and we will say so here when we have it.
Questions from your IT person or compliance officer?
We will walk them through every step, and send our BAA to review before anything is connected.