Security and privacy
Protect API credentials, patient identity, clinical content, and operational records in your integration.
The organization token authorizes access to your Doctronic API scope. Treat it as a production
secret. The X-Doctronic-User-ID selects a user inside that scope but is not a credential by
itself.
Integration boundary
- Call the Doctronic API from infrastructure you control.
- Store tokens and webhook secrets in a server-side secret manager.
- Authenticate the current patient before resolving a Doctronic user ID.
- Keep staging and production credentials, users, logs, and configuration separate.
- Restrict access to clinical content and identifiers according to job need.
- Use the documented HTTPS endpoints and validate TLS normally.
Do not place a token or secret in browser code, a mobile binary, a model prompt, source control, client-visible configuration, analytics, screenshots, or logs.
Data minimization
Send only the patient information and clinical context required for the approved workflow. Keep credentials and internal routing instructions out of prompt context. Limit operational telemetry to the identifiers and event metadata needed to investigate an issue.
Consultation documents can contain sensitive clinical information. Apply your approved access, retention, display, export, and deletion controls when storing or presenting them.
Logging and support
Retain the X-Request-ID response header with local request metadata. It helps Doctronic trace a
request without requiring you to send credentials or unrestricted patient content through email.
When reporting a problem, provide the environment, endpoint, UTC time, response status, error code, and request ID. Send patient information only through a channel approved for the integration.
Review before production
Security, privacy, permitted data, retention, and incident procedures depend on the implementation and governing agreement. Confirm them with your Doctronic business or implementation contact. Do not infer enterprise commitments from the consumer privacy notice or from this public technical documentation.
For a detailed security review or supporting documentation, contact your Doctronic implementation contact. If you do not have one, email business@doctronic.ai without including credentials or patient information.