TheatreLink
Request a demo
HomePlatformTutorialsFAQPricing
Legal
Privacy PolicyTerms (EULA)Security
Sign inRequest a demo
Legal

Security & Privacy

TheatreLink is designed with security at its core. Here is how we protect your data.

Encryption in Transit

All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher, with TLS 1.3 used wherever the connection supports it.

Encryption at Rest

All data stored in our database is encrypted at rest using AES-256 encryption, the industry standard for healthcare data protection.

Australian Data Residency

Patient records are stored in Australia, in AWS’s Sydney region, with encryption keys replicated only to AWS Melbourne. AI-assisted document processing runs in Australia on Amazon Bedrock. A small number of service providers (email, SMS, payments, product analytics and error monitoring) may process limited data overseas; these are disclosed in our Privacy Policy and handled in accordance with the Australian Privacy Principles (APP 8).

Multi-Factor Authentication

All user accounts support MFA via authenticator apps (TOTP) and passkeys (WebAuthn: Face ID, Touch ID, Windows Hello or a phone). MFA is required for every staff account.

Role-Based Access Control

Every user is assigned a specific role (Theatre Manager, Surgeon, Practice Manager, etc.) with access strictly limited to the data and actions relevant to their role. Hospital data is isolated per hospital: users see only the hospitals they are affiliated with.

Audit Logging

All significant actions (accreditation changes, booking approvals, session modifications, login events) are recorded in an audit log retained for compliance and security monitoring. Admissions and consent events are additionally recorded in a tamper-evident, hash-chained and cryptographically signed audit trail.

Patient Information

TheatreLink is a theatre scheduling, coordination, and admissions platform. By default, booking records contain operational data only — procedure names, equipment requirements, scheduling details — and do not include identifiable patient information.

Hospitals may optionally enable the Admissions & Consent module, which collects patient demographics, medical history, and procedure consent on the hospital’s behalf. When this module is in use, every patient record is protected by record-level AES-256-GCM envelope encryption: each record has its own Data Encryption Key, which is itself wrapped by a master key held in a managed Key Management Service. One-way HMAC-SHA256 hashes support patient matching without decryption.

Admissions and consent events are recorded in a hash-chained, cryptographically signed audit log, timestamped by an external RFC 3161 Time Stamp Authority where that service is available, so that tampering is detectable. Patient-facing tokenised links are protected by a second factor (date of birth + postcode) and expire after a short window. The full data-handling description is in our Privacy Policy, and the platform’s data flows are documented in a Privacy Impact Assessment (currently issued for review and sign-off) that hospitals review as part of their information-governance approval.

Infrastructure

  • Hosting: Vercel (Sydney edge region) with automatic SSL/TLS certificate management
  • Database: Neon PostgreSQL (AWS Sydney) with connection pooling and encrypted connections
  • File Storage: Encrypted blob storage for accreditation documents
  • Email: Resend — transactional and inbound email only, no marketing communications
  • SMS: Twilio — notifications and verification codes only
  • Real-Time: Pusher — encrypted WebSocket connections for live calendar updates
  • Error Monitoring: Sentry — error tracking with PII scrubbing enabled
  • Encryption Keys & AI: Amazon Web Services (KMS and Bedrock) — Sydney, with a Melbourne key replica

Security Headers

  • HSTS: Strict-Transport-Security enforced with 2-year max-age and preload
  • X-Frame-Options: SAMEORIGIN — blocks cross-origin framing (clickjacking) while allowing the app to embed its own same-origin previews
  • X-Content-Type-Options: nosniff — prevents MIME type sniffing
  • Referrer-Policy: strict-origin-when-cross-origin
  • Permissions-Policy: Camera, microphone, and geolocation access disabled

Compliance

  • Australian Privacy Act 1988: Patient records stored in Australia (AWS Sydney); access controls and tenant isolation enforced; any overseas processing by service providers is disclosed in our Privacy Policy and managed under APP 8
  • OWASP Top 10: Application security reviewed against OWASP guidelines including SQL injection prevention (Prisma ORM), XSS protection (React auto-escaping), CSRF protection (NextAuth tokens)

Responsible Disclosure

If you discover a security vulnerability in TheatreLink, please report it to security@theatrelink.com.au. We take all reports seriously and will acknowledge them promptly.