Trust, Security & Privacy

Lazomis is a clinician-focused healthcare improvement platform. This page summarises the security, privacy and data-handling controls applied to the Lazomis QI platform and its internal administration tools (including the Product Registry).

This page is maintained by the Lazomis team. It is not an independent certification and should be read alongside your own organisation's information governance review.

Authentication & access control

• All user accounts are authenticated through Lovable Cloud (Supabase Auth).
• Role-based access uses a dedicated user_roles table with a security-definer check; roles cannot be self-assigned through the application.
• Privileged administration features (e.g. the Product Registry) require the platform_admin role and are gated server-side, not just in the UI.
• Organisation admin access requires manual approval by the Lazomis platform admin team.

Tenant isolation & data scoping

• Multi-tenant data is isolated using PostgreSQL Row-Level Security policies enforced at the database layer, not in the frontend.
• Every organisation-scoped record is filtered by organisation membership before being returned to the client.
• Demo data is kept separate from live data and is clearly labelled.

Data handling

• Data is encrypted in transit (TLS) and at rest by our managed backend provider.
• Service-role credentials are server-only and never shipped to the browser; client code uses publishable keys subject to RLS.
• Uploaded files are organisation-scoped; public buckets are not used for clinical data.
• The Product Registry is the single source of truth for which tools are live, in testing, hidden, or archived. It is automatically re-validated every 24 hours.

Clinical safety & governance

• Lazomis QI supports — but does not replace — clinical judgement. Local policy, formulary and specialist advice should always be followed.
• National guidance (NICE, NHS England, UKHSA, Royal Colleges, National Audits) is the reference standard for clinical content. Local thresholds are not invented by the platform.
• All exports and reports are organisation-scoped and intended to support governance review, not bypass it.

Reporting a concern

To report a security concern, request a data processing summary, or ask about information governance, contact the Lazomis platform admin team at support@lazomis.co.uk.