What is built, described precisely.

Every product records a time-stamped history of data changes attributed to a named user, on a database separate from the operational one. Audit records reject being updated or deleted — an attempt raises an error rather than succeeding quietly.

Each audit event carries the hash of the event before it. Altering a past entry breaks the chain from that point onward, which makes tampering detectable rather than merely prohibited.

StudyCore and Nubiss Clinical record the previous and new value of a changed field and show a field-by-field difference. TelMed's audit stream deliberately records which fields changed and their hashes rather than the values, to keep patient data out of the log.

StudyCore captures a reason when a record is signed or a signature is removed. No product prompts for a reason on an ordinary data edit.

TLS is enforced with HTTP Strict Transport Security including subdomains and preload, a content security policy, secure and same-site cookies, and short session lifetimes. Database connections require TLS.

Nubiss Clinical encrypts national identifiers, insurance numbers and message bodies in the database, searchable only through a separate hashed value. StudyCore encrypts participant names and local record numbers — but not date of birth. Other products rely on infrastructure-level encryption only.

Uploaded documents are stored with server-side encryption and served through short-lived signed links. Uploads are checksummed and image metadata is stripped.

StudyCore subjects carry a study identifier, sex and year of birth and no direct identifiers; identifying details are held separately. We describe this as pseudonymised, not anonymised, because re-identification remains possible by design.

Permissions follow a role, scoped to an organisation and where relevant to a study or site. Access checks fail closed: an unmatched scope returns an empty result rather than everything.

A request for another organisation's record returns not-found rather than forbidden, so the response never confirms that a record exists. This behaviour is covered by tests.

Available in Nubiss TelMed as time-based one-time codes with printable backup codes, and enforced for administrative access. Not yet available across the other products.

Repeated failed sign-in attempts lock the account for a cool-off period. Administrative interfaces are served from a non-default path.

StudyCore requires the signer's password again at the moment of signing and binds the signature to a SHA-256 hash of the record as signed, re-verified on view. Nubiss Clinical signs documents with a verification hash and a checkable certificate.

Consent is recorded with its version, method, time and the person who recorded it. In TelMed a paper consent can be printed, signed, scanned back in and stored with a document hash.

A TelMed consent under § 367 SGB V is reusable for up to twelve months from the date it was given. Superseding one writes a new record rather than editing the old, so which version was in force on any past date stays reconstructable.

There is no eConsent module and nothing collects a patient's signature on screen. Consent is either entered by the person who took it or signed on paper and scanned back in — which is a documentation step in your process, not an automated one in ours.

Nubiss Clinical provides a patient data export and an erasure workflow that respects statutory medical retention periods. The other products handle access and erasure requests manually; Longevity exports adherence data as CSV and has no self-service account deletion.

Where a person's data can be shared with a care or performance team, the permission is a dated record with a defined scope. Withdrawing it is recorded rather than erasing the original grant.