Security and data handling

A practical overview for professionals and organization procurement teams. Updated October 12, 2026.

Download the security and data-handling overview (PDF)

What the platform is for

OneProfile organizes healthcare workforce credentials and professional records. It is not designed as a patient chart, clinical record system or a place to upload patient information.

Information we process

Account and contact details, career and credential records, uploaded documents, organization roster and role requirements, sharing permissions, support requests, service usage and security logs.

Access and sharing

Server-side controls restrict record access by ownership, role, organization and permission. Professionals control Passport sharing through expiring, revocable links. Recipients may retain information they downloaded while access was active; revocation does not retrieve those copies.

Document protection

HTTPS protects the connection. Uploaded documents are encrypted using AES-256-GCM before storage. This describes document files, not application-level encryption of every database field. Account settings offer optional authenticator-app multifactor authentication.

Retention and requests

Use account settings and signed-in support to request export, correction or account closure. Retention can depend on service needs, audit history and lawful obligations. Contact us for a review of your organization’s specific requirements; this overview does not promise a particular retention schedule.

Procurement questions

Ask us about your intended data, hosting and service-provider requirements, contractual terms and access needs before using the platform. This overview is not a business associate agreement, an independent assurance report or a certification. We do not claim that a BAA is currently available.

Contact: info@oneprofilehealth.com. Read the security page and Privacy Notice for current disclosures.