Encryption
- Data in transit uses TLS (HTTPS)
- Data at rest is encrypted in the cloud database and file storage
Role-based access
- Every user has a role per facility (Staff, Manager, or Administrator)
- The database enforces that you only see rows for your active facility
- See Roles and permissions
Audit logging
Sensitive actions write to activity logs (Administrator access). Medication corrections and incident updates retain history rather than silent deletes.Sessions
- 45-minute inactivity timeout signs you out automatically (HIPAA requirement for clinical systems)
- Administrators can terminate active sessions for a user at their facility
- Review your devices under Profile settings → Security
Multi-factor authentication
Manager and Administrator roles must verify their identity with a one-time email code each workday. After signing in with email and password, ImaraCare sends a 6-digit code to your registered email address. Enter the code to proceed — no authenticator app or QR code is required.- Codes expire after 10 minutes
- Verification lapses after 8 hours — you will be asked again on the next workday
- If a code does not arrive, use the Resend code option on the verification screen
Your responsibilities
- Use strong unique passwords
- Do not share accounts
- Lock workstations in shared areas
- Report suspected unauthorized access to your Administrator and support immediately
Legal documents
- Privacy policy
- Terms of service
- DPA — Data Processing Agreement