Trust & security
Patient control must be infrastructure, not a promise.
Lyvra is designed for regulated healthcare environments. Consent is enforced by the server on every request, access is time-limited and audited, and every record keeps its provenance.
Patient control
The authorization model.
A share in Lyvra is an explicit, bounded authorization, not a permanent connection.
The patient decides
Who, why, what and for how long. A share can be the whole record, a single visit or selected items.
A short-lived presentation
The clinician receives access through a one-time code that expires quickly, not through a password or a search.
Server-side authorization
Every request is checked against the active authorization. What the screen shows is the result of that check, never a substitute for it.
Only permitted records
Anything outside the authorization is simply not returned. Access ends on time or when the patient ends it.
Controls
Protection at every layer.
Encryption
Patient data is encrypted at rest. Encryption keys are managed in a dedicated key-management service and never stored with the data.
Provenance
Every record keeps where it came from: the hospital system, laboratory or the patient. Nothing is silently merged or reinterpreted.
Auditing
Every clinician view and family view is recorded and visible to the patient in their activity.
Least privilege
Production systems run with narrowly scoped permissions, and administrative access is separated from the running service.
Deletion and erasure
Patients can ask to delete their account. Erasures are recorded so that they continue to apply even after a system restore.
Backup resilience
Backups are versioned and protected against deletion or overwrite for a fixed retention period, and restores follow a tested procedure.
Privacy by design
Data minimisation through scoped sharing, purpose recorded with every authorization, and patients able to see and end access. Our Privacy Policy sets out what we collect, why, and the rights you have.
Security questions and disclosures
Hospitals, partners and researchers can contact us about our security practices or to report a potential vulnerability. We review every report.
This page describes Lyvra’s design and controls. It is not a certification. Specific obligations are set out in our agreements and policies.
Lyvra Health
Trust is the product.
If you are evaluating Lyvra for your institution, we are happy to walk your security and clinical teams through the model in detail.