Security

All data transmitted between your device and CancerPath is encrypted using HTTPS (TLS). This ensures that information such as login credentials, health interactions and personal data cannot be intercepted or read by third parties while in transit.

Sensitive personal data stored on our servers is encrypted at rest. This means that even in the unlikely event of unauthorised access to our storage systems, the data remains protected and unreadable without the appropriate decryption keys.

User authentication is managed through a secure authentication system. We support email and password login as well as OAuth-based sign-in via trusted providers such as Google. Authentication tokens are managed securely and are not stored in plain text.

Passwords are never stored in plain text. We use industry-standard hashing algorithms to transform passwords before storage, ensuring that even our own team cannot view your original password. When you log in, the hash of your entered password is compared to the stored hash.

Active sessions are managed using secure, time-limited tokens. Sessions expire automatically after a period of inactivity, reducing the risk of unauthorised access on shared or unattended devices. Users can also log out at any time to terminate their session immediately.

Access to user data is restricted to authorised personnel only, on a least-privilege basis. Administrative access is granted only where necessary and is reviewed periodically. No member of the team has unrestricted access to all user data.

We maintain audit logs of key system activities, including authentication events and administrative actions. These logs help us detect, investigate and respond to potential security incidents and support accountability across the platform.

CancerPath conducts regular security reviews as the platform develops. This includes reviewing our architecture, access controls, dependencies and development practices to identify and address potential vulnerabilities.