Security and privacy
Your records stay with you.
Lulu EMR doesn't have a server. Every record lives on computers your organization controls, encrypted, and nothing is ever sent to us.
Encrypted on disk
Records, documents, backups and exports are all encrypted with AES-256-GCM.
No internet
There are no accounts, analytics, telemetry or update checks, so there's nothing to allow through a firewall.
Locked by default
It opens with Touch ID, Windows Hello or Face ID, and locks itself when it's left alone.
A record you can trust
Signed notes lock, every edit is kept, and shares and syncs are logged.
How it's built
- No server. Each installation keeps its records on its own computer. We have no copy of your records, passphrases or keys, can't get to them and can't recover them.
- No network. The app runs under a Content-Security-Policy that blocks every network connection. The one exception is a Mac paired with an iPhone, where the app talks to the sync helper on that same Mac.
- Nothing leaves without you. Data only leaves a device when someone chooses to send it: as an encrypted export, a password-protected PDF, a spreadsheet without names, or a home-program handout emailed as a draft you review and send.
Encryption
| Records | AES-256-GCM, with a new random IV for every file. If a file is altered in any way, it won't open. |
|---|---|
| Data key | A random 256-bit key. On the Mac it's kept in the Keychain, for this device only and only while it's unlocked. On Windows it's protected with DPAPI for the current user and doesn't roam. |
| Unlock | Touch ID or the Mac password, Windows Hello, or Face ID or a passcode on iPhone. The app only learns whether unlocking succeeded. |
| Documents | Each PDF or photo has its own AES-256-GCM key, a random file name and a padded size. |
| Exports | Encrypted .emrx files with their own passphrase of at least 10 characters. |
| OneDrive backups | Encrypted with a separate backup key that only the backup passphrase (Argon2id) or a printed recovery key can open. The files are hash-chained, so tampering, missing files and rollbacks are caught. |
| iPhone sync | Paired once with a code (P-256 key agreement), then encrypted end to end for each phone, over the local network only. |
| Shared PDFs | Password-protected, and each share is logged. |
Access and accountability
- Automatic lock. Lulu EMR locks after 5 minutes without use (you can change this), when the computer sleeps and when the screen locks. Sensitive settings ask you to unlock again.
- Edit history. Every record keeps what each edit replaced, and you can undo. Signed notes can't be changed, so corrections go in dated addenda.
- Review before saving. Changes to names, birth dates, medical alerts, medications, diagnoses and dates are shown to you to confirm first.
- Activity history. Saves, backups, restores, shares and syncs are logged, without anything from the records themselves.
- Kiosk. The sign-in station never shows records, and leaving it takes a PIN, Touch ID or Windows Hello.
Integrity and recovery
- Every write is read back and checked, and backups are never overwritten.
- Each computer backs up daily, and again before every restore, merge or upgrade.
- Off-site copies go to a OneDrive folder you choose. Microsoft's OneDrive app uploads them, and Lulu EMR itself never connects to Microsoft.
- Nothing is deleted behind your back. Damaged files are moved to an archive, and a damaged record falls back to the newest backup that reads correctly.
Diagnostics and support
For troubleshooting, Lulu EMR keeps a short log on the computer with names, email addresses, phone numbers and chart IDs stripped out. It only leaves the computer if someone saves it and sends it. Support never needs athlete information, so please never send any.
Compliance
For IT departments
The technical security overview goes into the encryption, key storage, network policy and supply chain. The administrator guide covers silent installs with Jamf, Kandji and Intune, where files are kept, backups and permissions. Every download comes with SHA-256 checksums.
Found a security problem? Please let us know, and leave out any student information.