Following the recent news surrounding cybersecurity vulnerabilities in PHP, we wanted to take a moment to reassure you that protecting your patients’ personal and sensitive health information is a priority for us.
The recent reports relate to vulnerabilities in PHP, a programming language that GlowdayPRO does not use.
Our platform uses a different technology stack, hosted on Microsoft Azure. While these specific PHP vulnerabilities do not directly apply to our application simply because we use a different language, we recognise that cybersecurity is an ongoing responsibility and remain committed to protecting the information entrusted to us.
We understand how important it is to know that the medical histories, consent forms and treatment records you manage are handled securely. We have built multiple layers of protection into our platform to help safeguard patient data.
How we help protect your patients’ data
🔒 Encryption and data protection
Patient records are encrypted at rest, with FIPS 140-2 Level 2 validated Hardware Security Modules (HSMs) used to protect sensitive data and cryptographic keys. Data transmitted between users and our platform is protected using encrypted connections, helping keep information secure both when stored and in transit.
🔐 Secure account access
We use Microsoft Azure AD B2C for identity management, meaning user authentication is handled by Microsoft's identity service rather than by a password database within the GlowdayPRO application itself. Multi-factor authentication (MFA) is also available to practitioners and patients, providing an additional layer of account security.
🗂️ A data architecture designed with separation in mind
Rather than storing all patient information in a single database, our platform distributes patient data across multiple databases. No individual database contains a complete set of data for a patient. This approach adds another layer of separation within our data architecture.
🩺 Patient information handled in the right context
Our platform is designed to associate medical forms with confirmed appointments. Patients complete their medical histories within their own secure accounts, and access to their information is governed by platform permissions and applicable data protection arrangements.
☁️ Secure cloud hosting and monitoring
GlowdayPRO is hosted on Microsoft Azure, using cloud infrastructure capabilities to support our security arrangements, including logging, monitoring and backups. These measures help us oversee our environment, identify potential issues and support data recovery when needed.
📈 Continually strengthening our security practices
Security is not a one-off exercise. We're committed to reviewing our safeguards, managing risks and responding to relevant developments in the cybersecurity landscape.
As part of this commitment, we're currently working towards ISO 27001 certification and SOC 2 attestation. These frameworks support a structured approach to information security, risk management and the protection of sensitive information.
Our commitment to you
We recognise the trust you place in GlowdayPRO when managing your patients’ information.
While no online platform can eliminate every security risk, we are committed to maintaining appropriate safeguards and continually strengthening the way we protect sensitive data.
Thank you for being part of the Glowday community and for trusting us to support your aesthetic clinic and your patients.