Security and hosting
PneumoTrack runs inside your hospital, or at the publisher in Europe. Either way, your patients’ data stays in a database that belongs to no device supplier, and your IT department keeps control of access.
Your hospital network
PneumoTrack
Hospital Windows server
SQL Server
Your database, your backups
No patient dataleaves the network
Updates and licencechecked occasionally, 30-day offline grace period
Who gets in, and how
-
Hashed passwordsPBKDF2-SHA256 with 600,000 iterations and a per-user salt, following the OWASP recommendation. The password is never stored in plain text.
-
Password policyAt least eight characters, with at least one uppercase letter, one lowercase letter and one digit.
-
Brute-force protectionAfter five failed login attempts, the account is locked for fifteen minutes.
-
Screen lockTwenty minutes of inactivity and the session locks. One click lets you switch user.
-
Permissions by profileDoctor, technologist, admin staff, administrator: each profile sees only the screens and actions of its own work, even for an address typed by hand.
-
Limited sessionsA session lasts eight hours and is only extended while the user is working.
Data kept safe, even when the network falters
Your server, your database
PneumoTrack is installed on a Windows server at the hospital and writes to your SQL Server. Backups, access and retention stay with your IT department.
Monitored connection
The database is checked every 15 seconds. If it stops responding, a red banner warns the user before any entry is lost.
Automatic recovery
A brief network outage triggers up to five retries. At startup, the software waits until the database is available.
Audit log
Who changed what, and who opened which patient record. Kept for ten years, readable and exportable by the administrator.
Web protections
HTTPS enforced with HSTS, protection against request forgery, security headers against embedding in other pages and content sniffing.
If you choose hosting by the publisher
You then have no infrastructure to plan. Here is what we commit to, and what your IT department will want to check.
One database per hospital
Never a shared database across centres. Your data sits next to nobody else’s, and a restore concerns only you.
Hosting in Europe
The hosting provider is European and ISO 27001 certified. Its name, its certificates and the list of its own subcontractors are in the contract, before signature.
Encrypted backups, tested restore
Daily backup, kept off the server that runs the application, with a verified restore. A backup that has never been restored is worth nothing.
Signed data processing agreement
The hospital remains the controller, the publisher is the processor. The contract sets out purposes, duration, security measures, and what happens at the end.
You can leave whenever you want
Full export of your data at any time, in a readable format. At the end of the contract the data is returned, then erased on written confirmation.
The same protections as on your premises
Hashed passwords, lockout after repeated failures, session locking, audit log kept ten years: it is the same software, so the same safeguards.
Management software, not a medical device
PneumoTrack organises the administrative follow-up of agreements: dates, approvals, devices, providers. It makes no diagnosis and adjusts no device. The medical decision remains entirely with the doctor.
On the security roadmap
- Sign-in with the hospital’s Active Directory accounts
- Managed hosting in Belgium for centres without an available server
Everything else on this page works today.
Your IT department’s questions
Who is responsible for the data under the GDPR?
Your hospital, as the data controller. Installed on your premises, PneumoTrack sends us no patient data: we have no access to it, except during a support session that you request and control.
Does the software send data outside the hospital?
No patient data. The server occasionally queries our update channel and checks the licence. Without a connection, it keeps working for thirty days.
What infrastructure is needed?
A Windows server on the hospital network, with IIS or the built-in web server, and a SQL Server instance. Workstations simply use a recent browser.
Is PneumoTrack a medical device?
No. It handles the administrative follow-up of agreements and makes no diagnosis. It does not fall within the scope of European Regulation 2017/745 on medical devices.
Does your IT department have questions?
We answer your IT department directly: architecture, server requirements, backups, updates. Write to us or request a technical demo.