# Security & privacy
- 15-minute access tokens with rotating refresh tokens.
- 2FA (TOTP) optional per user.
- Audit log records privileged changes (owner-visible).
- PDPL export / erasure workflows for patient data requests (owner role).
Never share your password or PIN; clinic owners manage role permissions centrally.