Targets, not a compliance badge
PHIPA (Ontario), PIPEDA (Canada), and Canada data residency are design targets plus the controls listed on this page. This app does not claim that RFH Order Desk is PHIPA-compliant, PIPEDA-compliant, HIPAA-compliant, or certified.
Who can use it
Sign-in is email + one-time code. Staff on @rainvillehealth.com and @tfhn.ca may self-register that way. Every other domain is rejected before a code is sent and signed out if it appears. There is no public Sign up button and no password field. Full Access, Staff, and Read Only are Postgres RLS roles on clinic_members after schema version 7 — not labels painted in the UI. A first login stays pending until Full Access adds the person on Team (the first clinic member becomes Full Access automatically). A code does not grant Kanban write access by itself.
What this app must not store
RFH Order Desk’s database is not a designated PHI store. Do not put chart numbers, diagnoses, clinical notes, or Lab Cases chart fields here. Staff Purchases may hold a person’s name, an operational item, dates, an optional pickup email, consent timestamp/purpose, and staff notes. Those are order fields, not a chart.
Lab Cases stay separate
Lab PHI stays in the Lab Cases app at https://rcpc-lab-cases.vercel.app. RFH Order Desk only stores an optional case URL or id and shows those as reception tiles on Lab. Lab Cases uses a different Auth project, so a second login is expected. Inventory Free/Pro (this Supabase project) does not inherit a Lab Cases BAA or HIPAA coverage.
Where data lives
The hosted edition uses Supabase project djocthtjeooidcshscdg in Canada Central (ca-central-1). Photos use a private bucket. There is no QuickBooks connection. clinic_id is membership RLS for this one clinic, not a multi-clinic switcher.
Controls we actually ship
- Domain-gated OTP Auth for @rainvillehealth.com and @tfhn.ca; Magic Link codes; no password Sign up UI.
- Row-level security: Read Only cannot write clinic orders.
- Operational audit rows on staff purchase changes.
- Patient notices require a contact email, consent timestamp and purpose, a send-time confirmation, and a message log. Templates are ready-for-pickup and follow-up only.
- Secrets stay in environment variables, not the git repository.
What we do not claim
No SOC 2, ISO 27001, HIPAA BAA, or completed PHIPA audit. Email sending depends on Resend (RESEND_API_KEY) with a rainvillehealth.com From address such as orders@rainvillehealth.com or noreply@rainvillehealth.com. Do not send from beforeandafter.clinic. If that key is missing, notices are logged as unsent instead of failing silently.