SECURITY & DATA HANDLING
Practice insights.
Without patient records.
A straightforward guide to the data used in ClinicGauge’s aggregate practice analytics and how access is protected.
Updated October 16, 2026
What data is stored?
The practice analytics workflow uses aggregate business data: totals such as collections, production, marketing spend, lead counts, and conversion rates. These numbers describe practice performance without identifying individual patients.
Account and staff details needed for sign-in and access, along with information you submit in a business inquiry, are separate from these aggregate metrics. “Aggregate data only” describes the analytics inputs; it does not mean the service stores no account information.
How patient information stays out
Patient-level records are not needed for aggregate reporting. Prepare summary totals in your existing systems before entering or importing data into ClinicGauge. Do not upload patient lists, names, dates of birth, contact details, medical record numbers, diagnoses, or treatment notes. Removing names alone is not enough if the remaining information can identify a patient.
This workflow keeps PHI out by using totals from the start. Do not assume an import or free-text field will automatically remove sensitive information. Keep patient information out of support requests and website forms, too.
Encryption
Clinic data is encrypted in transit and at rest. Encryption protects data while it travels between your browser and the service, and while it is stored.
Role-based access
Permissions limit access according to a user’s assigned role. Give each team member the access they need for their work, and review access when responsibilities change.
Clinic-level separation
Clinic data is separated by clinic, and access is scoped to authorized users. An account with one clinic does not, by itself, grant access to another clinic’s information.
What “HIPAA-aware” means here
ClinicGauge’s aggregate analytics are designed to work without PHI. This page explains that data boundary and the controls described above; it is not a HIPAA certification or a determination of your practice’s compliance. It covers aggregate practice analytics, not any separate patient-facing workflow.
Before sharing a dataset you are unsure about, ask us about its structure without sending the patient information itself.
Questions about your data?
Email success@clinicgauge.com. For marketing-site analytics and cookie choices, see our website privacy notice.