Your data, and what happens if we disappear

Task	Last run	Result
Local backupHourly, on the clinic server	09/08 15:00	Complete
Encrypted cloud backupEncrypted here before upload · the key is yours alone	09/08 02:15	Complete
Restore testRuns every 90 days, automatically	21/07	Restored and verified
Data exportCSV and PDF, open formats	–	Available in every licence state

Encrypted where it sits

The database file is encrypted on disk. A stolen clinic PC is a stolen PC, not a data breach. Access inside the clinic is by named user account with a role, never a shared login, because an audit trail that says “reception” tells you nothing.

You hold the key. We hold none of it.

Every backup is encrypted at your clinic, and the key that opens it is yours alone. It is printed on two sheets the day we install: one for your safe, one to keep somewhere outside the building, and either can be reprinted at any time.

In version 1 that sentence is even shorter than we planned: no copy of your database reaches us at all, because sending one to Klinira Cloud is the release after this one. The other half matters just as much and you should read it here rather than discover it later: lose both printed sheets and nobody can open those files, including us.

Backups that go where you tell them

A backup destination is a setting, not something with our name built into it. Klinira writes to a second computer in your clinic, to an external drive, to your network storage, and to a folder in your own Google Drive, OneDrive or Dropbox, all on the same schedule: a full copy at closing time and the changes since, hourly, through the day. You can use every one of them at once, and none of them depends on us being reachable.

The computer holding the data can die too

This is the failure people forget, and it happens far more often than a company folding. One computer in the clinic holds the records and the rest ask it for answers. Make a second clinic PC one of your backup destinations and it holds a copy of the database that is at most an hour old, so when the first one dies at four in the afternoon you install Klinira on the second, restore that copy, and carry on the same afternoon.

Two things we are not going to overstate. That recovery is a restore your staff run, not one button — the one-button "make this computer the server" is designed and is not in version 1. And the copy is hourly, not continuous, so the work at risk is the last hour rather than the last ten minutes. Rehearse it once on installation day, while nothing is wrong: somebody who has done it once can do it in a panic, and somebody reading the instructions for the first time at nine in the morning cannot.

Restore is tested, not assumed

Klinira runs a restore test on itself every ninety days and tells you the result. A backup that has never been restored is a belief, not a backup, and clinics almost always find this out at the worst possible moment.

If we went out of business

Your clinic opens the next morning unchanged, because the software and the database are on your machine, not ours. In version 1 that is even more literally true than we designed it to be: we hold no copy of your database at all, so there is nothing of yours to lose with us. Perpetual licence holders keep full offline operation permanently. Export works regardless.

If we can give notice we commit to four things: ninety days of it, one action that downloads everything we hold on you, a final update that removes licence checking entirely, and a free recovery tool that reads your backup files. Those are commitments in the terms rather than things you can click today — the recovery tool is written and published before the first cloud backup exists, because that is the first moment it could matter.

Common questions

What format is the export?

Open formats, CSV for tabular data and PDF for documents, so another system or a person can read it without us.

Can I put the database on a shared network folder?

No, and Klinira will not let you. SQLite locking over SMB is unreliable and it corrupts databases. This is the most common way this class of software fails, so we removed the option entirely.