My Fisio AgendaProtected clinical records in your physiotherapy software
An initial assessment, the progress notes from each session or a consent signed before dry needling are health data, and they deserve more than a password. My Fisio Agenda protects them with HTTPS connections and a database encrypted at rest, encrypted daily backups on servers in the European Union, two-step verification by email and a PIN for the sections you choose. Included in every plan and ready in a couple of minutes from Settings.
Your physiotherapy clinic holds sensitive data too
An orthopaedic report, notes on a post-op knee or the follow-up of pelvic floor rehabilitation are health information, just as they would be in a hospital. The safeguards in My Fisio Agenda are built around what really happens in a practice: the front-desk computer left on between patients, the laptop you take on home visits, or the phone with your schedule open that one day goes missing.
Several barriers, not one
A password, an emailed code when signing in from a new device and a PIN for the most delicate areas. Get past one barrier and the next one is waiting.
You set the level
Nothing is mandatory: switch on 2FA if you want, pick which sections ask for the PIN and how long until it is asked again, from 30 seconds to an hour.
Built for the treatment room
While you are treating someone on the couch, the session can stay open at reception: with the PIN, nobody walking past can open clinical records or billing.
Devices under control
See which computers, tablets and phones have your account open, with their IP and last activity, and log out of one or all of them at once.
Activity log
Each device keeps a trail of the last 5 days —appointments created, records edited, files uploaded or invoices issued— that you can download as a PDF.
Data kept in the EU
Servers in France, an encrypted backup every night and a GDPR data processing agreement from the day you sign up.
How your physiotherapy practice is protected day to day
Two-step verification by email
If someone tries to get into your account from a computer or phone the system does not recognise, the password alone will not do: they also need a 6-digit code sent to your inbox. No extra apps and no SMS.
- Single-use code that expires after 10 minutes
- “Trust this device”: your clinic computer will not ask again for 30 days
- Attempt limits: the code locks after 5 mistakes, with a cap of 10 code emails per account each day
- Reload the page halfway through and you land straight back on the code field
- Linked devices listed with last sign-in and IP, so you can unlink one or all of them
- Turning verification off also unlinks every trusted device
Why email? It is an inbox you already check every day and can harden with its own verification. You do not rely on phone signal in the treatment room, or on a text message that could be diverted through a duplicated SIM card.
Security PIN by section
A 4-digit code the system asks for before opening the areas you select. It is the answer to the shared front-desk computer, or to those minutes when you step out of the treatment room for equipment and the screen is left in view.
- Whole pages: Agenda, Contacts (your patients), Session packs, Billing, Statistics, Reminders, Rooms or Settings
- Or single actions: viewing clinical records, deleting an appointment, creating or deleting an invoice, exporting a report, changing the password…
- Grace period of your choice before it is asked again: from 30 seconds up to an hour
- Temporary lockout after 5 wrong PINs within 5 minutes, enforced on the server
- In clinics: the manager can require it to open each physiotherapist’s agenda, patients, statistics, settings or billing
- A correct PIN only counts on the device where you typed it
Isn’t 2FA enough? They cover different risks: two-step verification stops someone trying to get in from outside; the PIN protects what is on screen in a session that is already open. Together they close both gaps.
Informed consent signed remotely
For the post-surgery patient who cannot travel yet, or to have the dry needling consent signed before the first session: create a unique link from their record and send it by WhatsApp, by email or by pasting it wherever you like. They sign on their phone without downloading anything.
- Personal link created from the patient record and valid for 14 days
- Sign with a finger or a mouse on a phone, tablet or computer
- “Awaiting signature” status in the record until the patient finishes
- Signed, dated PDF filed automatically with the patient’s documents
- Adult or minor template, with guardian 1 and guardian 2 details pulled from the record
- Picked the wrong template or patient? Cancel the pending link and create a new one
Less paper at reception. The document stays attached to the patient record with its signing date, rather than sitting in a physical folder where it can go astray.
Encryption, daily backups and servers in Europe
Safeguards applied to every account from day one, with nothing for you to configure.
HTTPS connection
Everything travelling between your browser and the server is encrypted, with no exceptions, including when you work from a phone or tablet.
Encrypted database
The tables holding patient records, clinical notes, appointments and patient photos are encrypted at rest.
Encrypted daily backup
Every night a copy of the database is created and encrypted with AES-256, and the copies from the last 7 days are kept.
Hosted in France
The servers are in France, inside the European Union, so your data is handled under the GDPR framework.
Processing agreement
When you sign up you accept the data processing agreement: you are the controller of your patients’ data and My Fisio Agenda only processes it to provide the service.
Files hidden by default
Anything you upload to a record is visible only to you until you choose to share it in “My Space”, the portal your patient opens with a code and PIN.
Protect your physiotherapy schedule today
Create your account, switch on email verification and choose which sections need the PIN: five minutes and your practice is covered. 1 month free, no card and no lock-in.
Questions about security and data protection in physiotherapy
Which patient data does My Fisio Agenda protect?
Everything you record: personal and contact details, session-by-session clinical notes, consent forms, photos, appointments, session packs and invoices. Data travels over HTTPS, the database is encrypted at rest and an encrypted copy is saved every night. Files you upload to a record stay hidden from the patient unless you decide to share them.
Where is the data stored?
On servers located in France, within the European Union. Daily backups are stored encrypted as well and kept for seven days.
How does two-step verification work?
It is optional and you switch it on in Settings › Security. When you sign in from a new device, after your password you receive a 6-digit code by email that stays valid for 10 minutes. Mark the device as trusted and it will not ask again for 30 days.
What can I protect with the security PIN?
Whole pages —agenda, contacts, session packs, billing, statistics, rooms or settings— and specific actions such as opening clinical records, deleting an appointment or exporting a report. You choose which ones, and how long passes before it is requested again, between 30 seconds and an hour.
Can I log out of a phone I have lost?
Yes. Under Settings › Security › Your devices you will find every open session with its IP and last activity. Close one in particular or all of them at once, and review what was done from each device over the last 5 days.
Is My Fisio Agenda GDPR compliant?
It is built so that you can comply as the controller of your patients’ data: you accept the data processing agreement when you register, information is hosted encrypted in the EU, and there are daily backups and access controls. Consent forms with a digital signature also help you document what you explain to each patient.
What can patients see of their own record?
Only what you share. In “My Space”, which they open with a code and a PIN, they see upcoming appointments, can cancel them or request a new one, download the documents you mark as visible and sign any pending consent forms.
Do the security features cost extra?
No. Two-step verification, the section PIN, device control and the activity log are included in every plan: Semilla, Junior, Senior, Centre Mini, Medium Plan and Centre Super.
What if I lose access to the email used for verification?
Message us on WhatsApp or from the email address linked to your account. We will confirm your identity before helping you regain access and set up verification again. We will never ask for your password.