Skip to content

Is patient data safe in a cloud queue system?

Every clinic's data is isolated, and every request is authorised against the clinic it belongs to — on the server, for staff and kiosks alike — rather than by hiding what the browser is allowed to ask for.

Last updated:

The question worth asking a vendor

Not "is it encrypted" — everything is encrypted, and the answer tells you nothing. The question is where the check happens.

If a system decides what you may see in the browser, then the browser is the security. Anyone who can open the developer console can ask for something else, and the server will answer, because the server was never asked to have an opinion. This is the most common way a small clinic system leaks, and it is invisible from the outside.

In QueueCare the check is on the server, on every request, without exception. A station asking for a queue that is not its clinic's does not get a filtered answer; it gets refused.

Isolated means isolated

One clinic cannot read another's queue, patients, or ledger, by any route — not through a URL, not through a guessed identifier, not through a station left signed in.

The waiting-room screen is held to the same rule, which is worth saying because it is the one device in the building with no person attached to it. A screen is scoped to the clinic it belongs to and can show nothing else.

What a queue system should not hold

QueueCare stores no clinical records. No notes, no diagnoses, no prescriptions, no history.

That is a design decision rather than a missing feature. A queue needs a name, a place in line, which doctor, and whether the visit was paid. Adding a patient's medical history to that would make the system more valuable to attack and no better at the job it exists to do. The safest data is the data that was never collected.

The one number this site publishes

The counter on the home page — the total number of patients moved through QueueCare — describes the platform as a whole and identifies nobody. No clinic name, no patient, no location, no breakdown.

It is the only figure published openly, and it is worth naming because a vendor that publishes usage statistics per client is a vendor that has decided your patient volume is its marketing material.

Questions clinics ask before they start

Can one clinic see another clinic's patients?

No. Every request is authorised against the clinic it belongs to on the server, so a request for another clinic's data is refused rather than filtered.

Does QueueCare store medical records?

No. It holds the queue, check-in, and the payments ledger for a visit. There are no clinical notes, diagnoses or prescriptions in it.

Who is the data controller?

The clinic. QueueCare processes patient data on the clinic's behalf and under its instructions; the clinic decides what is collected and why. The privacy policy sets this out in full.

What about the waiting-room screen, which nobody signs in to?

It is scoped to its own clinic and authorised the same way as any other station. It can display that clinic's queue and nothing else.

Guides for clinics

See it with your own queue in it.

Open the demo and you are standing inside a working clinic — doctors mid-session, patients in line, screens calling names. Nothing to install, nothing to sign.

Open the live demo