Technical overview

The essentials

• Stored in Beauharnois and backed up in Québec, with OVHcloud.
• No health information and no patient information.
• Passwordless sign-in, and team isolation in the database itself.

What RelèveMed does

RelèveMed is online software for scheduling medical on-call shifts. Physicians enter their availability, the calculation proposes a schedule, the person who manages it adjusts and publishes it, and fairness carries over from one period to the next. Access is by invitation only.

RelèveMed processes no health information and no patient information: only the names, email addresses, availability and shifts of team members.

Where the data is

• Application and database: with the Canadian subsidiary of OVHcloud, a French group, in Beauharnois (Québec). A single region for every team.
• Backups: in Beauharnois. A weekly encrypted copy is kept offline by the publisher, in Québec.
• Email (sign-in, invitations, notices): Cyberimpact, a Sherbrooke company whose servers are in Montréal.
• In the browser: no audience measurement, no third-party cookies, no script loaded from another domain. Authentication is not entrusted to any third party.

A physician who subscribes their personal calendar to their schedule (Google, Apple, Outlook…) sends their shifts to that service. That's their choice, and the service is not a subcontractor of the publisher.

Access and security

• Passwordless sign-in: a link received by email, valid for one hour, single use; a new link cancels the previous ones. The password is used to confirm your identity before a sensitive action; it is never stored in plain text.
• Two-step verification when confirming your identity: a code from an authenticator app, plus eight backup codes. Your organization can require it of its managers; it is offered to every member.
• Team isolation in the database itself, on top of the application: a query that doesn't name its team fails rather than return another team's data. Within a team, a physician doesn't see what colleagues have entered.
• Support, to help you out: the publisher opens a support session, which shows your team as a manager sees it, for one hour at most. They reconfirm their password and write a reason; a banner shows the session, and it is recorded in the team log your managers read. Each manager can ask for an email every time one opens. Outside these sessions, the application doesn't show your data to the publisher.
• The server: as with any hosted service, running it involves technical access to the database and backups. That access is for keeping the service running; not using it to read your data is a rule the publisher holds itself to.
• Logs: the team log records who did what, and when. Only the account-security log holds an IP address, erased after twelve months. Nothing in the application can modify or erase these logs.
• Encryption: HTTPS in transit; database disks encrypted at rest; exported backups encrypted with a key that is neither on the server nor with the host.

People's rights

Your organization holds the information and remains responsible for it; Bley Conseil acts as its agent, under a written contract.

Each person exercises their own rights, in the application, without anyone's approval (My data):

• a full copy of their data, as a file, produced on the spot;
• correcting their name and language; changing an email address goes through the publisher;
• deleting their account, which erases their identity. Their past shifts stay on the schedule as "Former member", because colleagues' fairness depends on them. Deletion waits until no upcoming published shift is in their name, and until someone else manages the team if they are its only manager. A deleted account still remains for at most fourteen days in the backups kept by the host, and for about four weeks in the weekly copy.

What the product doesn't do yet

• Two-step verification doesn't apply to sign-in, which stays by link: when it is turned on, it protects identity confirmation, and so everything that administers the team.
• Sign-in depends on email: until an email goes out, the sign-in link doesn't arrive.
• No import of a history from another tool: starting balances are entered by hand (Take over a history).
• No screen returns a whole team's data: at the end of the contract, the publisher returns it on your organization's written instruction.
• No read-only role.

Languages, accessibility, devices

• In French and English: each person picks their language and gets their emails in it; help is built into every screen, in both languages.
• Accessibility: light or dark appearance, and an automatic contrast check of every text colour on its background, at WCAG AA thresholds. No statement of conformance is claimed.
• Devices: the physicians' portal is designed first for the phone; the managers' workspace, designed first for a large screen, also works on a phone, schedule and corrections included. Up-to-date browsers; Safari and iOS 16 at minimum.