Current safeguards
- Personal charts, photos, exports, and capture sessions require sign-in and are scoped to the authenticated account.
- Administrator access is restricted to approved accounts, and administrator changes are written to an audit history.
- Sensitive pages and API responses use private, no-store caching rules; site-wide headers limit referrers, content sniffing, unnecessary device permissions, and unapproved content sources.
- Photo uploads are type-checked, size-limited, account-scoped, and request-limited. Public forms and signed-in submissions are throttled to reduce automated abuse.
- DoseCanvas does not intentionally put medication names, patient notes, or photos into product-event analytics.
Safe use
- Use a personal account and do not share sign-in access.
- Review every scanned or typed value against the current label and care-team instructions.
- Protect downloaded files and printed copies; dispose of obsolete copies securely.
- Do not send medical records, medication details, payment information, or identification documents through ordinary inquiry email.
Report a concern
Use the contact form and choose “Security or privacy incident.” Include only enough non-medical detail to help us respond; do not attach records or identification. DoseCanvas will triage the report, contain the issue, preserve relevant evidence, assess notification duties, and communicate as required.
Questions, requests, or concerns can be sent to utopiacharleston@gmail.com.
Current limits
No online service is risk-free. DoseCanvas is a testing service and is not represented as a HIPAA-compliant clinical system, electronic health record, medication-administration record, or emergency service. Organizational use with patient data remains closed pending a separate security and compliance review.