A clinic keeps health information. It shows in how Mayel is built.
An assessment, a consent and a photograph of someone’s skin are not ordinary data. This page says plainly who can see what, what is kept, and what happens to all of it if you leave.
Who can open what
One clinic never sees another
Every clinic is its own organisation, and every request is authorised against it on the server. A customer, a sale or a photograph belongs to one clinic and is only ever readable from inside it.
The screen is not the lock
Hiding a button is not security. Every request for a clinic’s data is checked for membership on the server, and sensitive actions are checked by role, so a link that was shared or a URL that was guessed changes nothing.
Sessions that end
A sign-in lasts as long as its token is valid. When it dies, Mayel says so calmly, brings you back to the same screen after signing in again, and never keeps you half-inside.
Passwords you can recover without us
A reset code is single-use and expires in ten minutes, and the confirmation reads the same whether or not the address has an account — so nobody learns who your team is by guessing.
Encrypted and isolated
Everything travels over an encrypted HTTPS connection, and each clinic’s data is isolated from every other clinic’s and reachable only by the people and roles it allows.
Six roles, and each one sees its own work
Roles are assigned by the owner and can be changed or suspended at any time. A specialist works with their own agenda and customers, and the owner decides who handles money, the team and the data.
- Owner
- Administrator
- Manager
- Front desk
- Clinical lead
- Specialist
Nothing with history is deleted
A customer with history is archived, never erased. A charge is voided with a reason. A merge keeps both histories. And key changes write a line in the audit ledger: who, when, and what the record said before and after. The ledger is read-only — not even the owner can rewrite it.
See the audit ledgerThe data is the clinic’s, not ours
Your customers, their records, your treatments and your figures belong to your clinic. Mayel holds them to run the service you are paying for: we do not sell them, we do not hand them to advertisers, and we do not mine them to build somebody else’s product.
Whenever you want, the account owner exports all your data: spreadsheets with your customers, treatments, sales, expenses, purchases, products and leads, and a compressed file with photographs and documents. They are the same files you would take with you if you decided to leave, and asking for them needs no permission from us.
Your clinic is responsible for it. We are the hands, not the owner.
Under Mexican data protection law your clinic is the controller of its patients’ personal data, and Mayel processes it on your instructions. We treat health information as sensitive: it is only reachable from inside your clinic and only by the roles you allow.
Mayel also gives you the instruments the law expects of you: signed consents kept with the session, explicit photo capture and publication permissions per customer, and a record of who recorded each one.
Ask us the hard questions
If your clinic has a compliance requirement, a data question or an auditor to satisfy, write to us. A straight answer is cheaper for both of us than a surprise later.
Request a demo or write to us at support@mayel.app