We cannot read your patients’ records, period.

In three sentences

Your patients’ records never leave your office unless you send them somewhere yourself, and nothing about you or your patients is ever sold, shared or used to train anything. Blues, the assistant, works on your own computer and can only read what the person using it could read, so a note is never sent to a server to be processed. The one thing that does leave is the encrypted backup, and we cannot open it.

Where a chart actually sits.

When a provider writes a note, it is written to a database on a machine the practice owns, encrypted at rest with AES-256-GCM. The key lives in the operating system’s own secure store — Windows DPAPI — not in a file we invented.

There is no step in that sequence where a readable note travels to us. Not for processing, not for “quality improvement”, not to make a feature work. The one time anything leaves your building is when you ask it to, and what leaves is already locked.

The assistant works the same way. Blues runs against a model on the same machine, so asking it about a patient does not put that patient in anybody’s API log. Unplug the clinic from the internet and it still answers.

What happens when you make a portable copy.

LogBlues can create an encrypted local export for storage controlled by your practice. Your clinic chooses the passphrase and the storage location. Keep the passphrase separately and test recovery before relying on any backup routine.

What we will never do with patient information.

These are not intentions. They are things the architecture makes impossible.

The part most vendors leave vague.

Ask any practice-software company where your records live and who can read them. The answer is usually “secure in the cloud”.

That means: on somebody else’s computer, readable by their staff under some policy, and worth money to whoever eventually buys that company.

We are not more virtuous than those companies. We simply cannot do that, because we never hold anything we can read. When a business changes hands, what changes hands is the software, not your patients.

What we hold about you, and it is small.

Everything above is about your patients. This part is about you, the clinic, which is a different question.

Customer data and patient data are two separate things. One is a business contact, so we can sell and support software. The other is a medical record. They are not stored together, and neither is sold.

In full, it is two things:

• Your email address, so you can sign in and we can send a receipt.
• Whatever you type into the contact form. The IP address and browser come with it, as they do with any form on the internet. We keep those only to tell a real enquiry from a bot.

That is the list. None of it is patient information.

The short list of companies any of this passes through was checked before we agreed to work with them, and we put the same questions to them that we invite you to put to us.

We use your email for four things and no others: the download link, answering you when you write to us, the product guides that show how each feature works, and support when you need it.

It is never sold, rented, or handed to an advertiser. We follow the CAN-SPAM Act, every message carries an unsubscribe link that works, and using it stops the email the same day.

Want the same thing in legal language? Read the Privacy Policy. To set the software up, start with Getting Started. For shorter answers to single questions, try the FAQ.

When a patient asks you a hard question.

“Who else can see my file?” is a fair question, and you should be able to answer it without calling support.

The answer is short: the people in this practice who have a login, and nobody else. Not the software company. Not a subprocessor. Not an analytics vendor.

A Business Associate Agreement is available on request, at no charge. Ask for it before you commit, not after — and ask every other vendor on your shortlist the same question, including us.

Try it free for two months How the security works →