​

Data model & privacy

Veridian Motion uses row-level security (RLS) on every table, scoped by facility membership, plus field-level PHI encryption (AES-256-GCM where PHI) and a hash-chained audit log. HIPAA-aligned, not HIPAA-certified. A BAA is required before production PHI. Current Lovable builds use synthetic data only.

​

Core clinical / portal entities

​

Medical Intake

Emergency contact is intentionally omitted (facility security).

​

Precision Rehab (rehab_*)

​

Chess Wellness (chess_*)

No patient-vs-patient matchmaking or chat tables.

​

Programs & licensing

Access rule: facility has an active entitlement AND patient has an active enrollment within the seat cap. See Programs & licensing.

​

Legal documents & consent

See Terms & patient consent.

​

Multi-facility isolation (rolling out)

When enabled, each facility’s patients and staff are isolated through RLS by facility membership (private.has_role(), private.is_facility_member()). warden / officer see operational data only — no clinical PHI.

​

Row-Level Security (summary)

​

Audit log

Hash-chained entries for: enroll, assign, review/approve, notes, roles, MFA reset, messages, Communication Record access, program enrollment changes, legal acceptances. No clinical content in audit payload.

​

Agency vs. application

​

What’s next