Organization isolation
Every operational record belongs to one organization. Queries and permissions are evaluated in that organization’s context — there is no shared pool of clients or cases across practices.
Security and GDPR
Organization data stays separate. Access follows roles.
This page explains how Efika approaches data protection in the product. It does not replace the privacy policy or the terms.
Access control
Access comes from membership and role in the organization (owner, admin, team). Removing membership ends access. Clients use the client portal, not the organization dashboard.
Processing rules
Efika organizes work: bookings, appointments, payments, reminders, and the day’s cases. It is not a clinical documentation system. Administrative documents stay separate from everyday cases.
Documents and the processing agreement
The document module requires acceptance of the current data processing agreement (DPA). Download links are short-lived and are not stored. Document contents are not analyzed by AI.
AI in one organization
AI reviews the schedule, calendar, and payments in the context of one organization. The prioritized action list stays in that organization — the team still decides and sends.
Retention and deletion
Data is kept for as long as needed to provide the service and meet legal duties. An account or organization can be deleted in the service settings. Retention periods are in the privacy policy.
Service providers
Data may be entrusted to providers needed to run the service: hosting, database, email, SMS, payments, and document storage. We do not sell data. Provider names and the full description are in the privacy policy.
Documents and contact
The full description of processing, recipients, and people’s rights is in the privacy policy. Terms of use are in the terms. For privacy and security questions you can book a demo — we reply in the context of your organization.