ClubCoreSecurity and privacy
Built to be trusted with minors and medical records
The rules below are enforced in the API, not in the screens, and covered by tests that run on every change.
Tenant isolation
Every query carries the tenant from the signed token. A client can never name another tenant.
Deny by default
Every endpoint declares the roles that may call it. Fourteen roles, from owner to parent.
Medical privacy by column
Diagnoses, clinical notes, treatment and psychology notes are selected only for the roles allowed to read them. Psychology notes are visible to the psychologist alone.
Immutable audit log
Every change writes who, what and the difference. The log cannot be edited or deleted, even by us.
Consent-based sharing
Emergency cards, wearable data types and medical passport exports all require recorded consent.
Your data leaves with you
Owners export the whole tenant as JSON at any time. Every list exports to Excel.