Privacy, access and security, stated plainly for health providers
The security facts QuoteCloud confirms, how to keep access tight inside your team, and what to ask before you send personal health information.
- 5/5 on G2
- 4.2 on Capterra
- Building QuoteCloud since 2013
QuoteCloud is hosted on Amazon Web Services with 256-bit encryption; personal information is stored on servers in the USA. Signers can verify with a one-time passcode, signed documents carry an audit trail and certificate, and roles, teams and content locking control who sees and edits what. QuoteCloud does not state HIPAA or health-record certification.
The consent section of a sample care agreement from a fictional provider, with locked wording, four acknowledgements and two signers, ending with the certificate of authenticity and audit trail. Beside it, a list of what QuoteCloud states ticks off: hosted on Amazon Web Services with personal information on servers in the USA, 256-bit encryption, an optional one-time passcode before signing, a certificate and audit trail, roles and teams (Essentials) and locked consent wording (Business).
What QuoteCloud states about security
Only what QuoteCloud says on its own pages, with the plan each one is on. Nothing here is a certification for health records.
Hosted on AWS, in the USA
QuoteCloud is hosted on Amazon Web Services, and personal information is stored on servers located in the USA. QuoteCloud states it is GDPR compliant.
256-bit encryption
Documents are protected with 256-bit encryption.
Legally binding eSignatures
eIDAS-compliant signatures, drawn, typed or uploaded, with no account needed to sign. On every plan.
A one-time passcode
Optionally send a signer a one-time passcode by email, to enter before they can sign.
Certificate and audit trail
Every completed document includes a certificate of authenticity and an audit trail, and has its own document ID.
No card details stored
Payments go through Stripe or PayPal. QuoteCloud does not store card details, and its staff cannot access them.
Roles and teams
Custom user roles, teams and role permissions for libraries, on Essentials and up.
Locked blocks and versions
Locked blocks stay non-editable in documents, and revisions are kept in version history. Business and up.
SSO and IP filtering
Single sign-on and IP range filtering for organisations on the Enterprise plan.
What goes in the agreement, and what stays in your clinical record
A suggestion for your privacy officer, not legal advice: keep each document to what the client needs to read and agree to.
Who in your team can see and change what
Custom user roles decide who can create, edit and send documents, and role permissions decide who can use or change each content library. Teams group your staff, for example by clinic or service.
On Business, consent wording and terms saved as locked blocks stay non-editable in every document, and revisions are kept in version history, so you can see what a client was sent before they signed.
- Custom user roles and teams: Essentials and up
- Content locking and version history: Business and up
- Single sign-on and IP range filtering: Enterprise
Consent and acknowledgement
Locked wording · your team can't edit it
Please read and confirm before signing. Rosalind signs as the client; Claire signs as her representative.
- I have read this plan and cost estimate, and my questions have been answered.
- I understand these are estimated fees. A change to the plan is sent to me as a revised agreement to sign.
- I agree that Kinfield Health may share this plan with my referring practitioner.
- I understand I can ask to change or end the plan at any time.
2 of 2 signed
- Rosalind AveryClient SignedWed 28 Oct, 10:12 am
- Claire AveryDaughter and representative SignedWed 28 Oct, 10:15 am
Paid on signing$916.00Paid via Stripe
Certificate of authenticity and audit trail attached
Agreement terms
- Changes to your planIf your needs change, we send a revised agreement for you to read and sign before the change starts.
- Cancelling a visitPlease give us 24 hours' notice. Visits cancelled with less notice are charged at the visit rate.
- InvoicesYour first week is paid when you sign. Each later week is invoiced by Kinfield Health.
- Your informationHow we collect, use and store your information is set out in our privacy policy, which we gave you at intake.
- Ending the agreementEither of us can end this agreement with 7 days' notice. It ends on its expiry date unless we agree a new one.
Bring your privacy questions to a demo
Ask about data location, access and retention before you start, or try QuoteCloud free for 14 days with sample data. No credit card required.
Stated plainly
Encrypted, on AWS, with an audit trail
Personal information is stored on servers in the USA. If your obligations ask for anything more, ask QuoteCloud before you send health information.
Questions to ask before you send health information
Privacy officers ask these about any software. Some are answered on this page; for the rest, ask QuoteCloud directly and check the answers against your own obligations.
- Where is our data stored? QuoteCloud states that personal information is stored on servers in the USA.
- Who in our team can see and change documents? Set this with custom user roles, teams and role permissions.
- How do we remove a document? Deleted documents go to Trash, where they can be restored; ask QuoteCloud about retention.
- Can we take our data with us? Ask about Export Document Data.
- What happens if there is a breach? QuoteCloud states it will tell you at the first reasonable opportunity.
- Who handles access and correction requests? QuoteCloud's Data Protection Officer.
- Do you complete security questionnaires? Book a demo and ask.
Privacy and security questions, answered
Where does QuoteCloud store personal information?
QuoteCloud is hosted on Amazon Web Services, and personal information is stored on servers located in the USA. QuoteCloud does not state a choice of data location, so if your obligations require data to stay in a particular country, check with QuoteCloud before you send health information.
Is QuoteCloud HIPAA compliant?
QuoteCloud does not state HIPAA compliance or any health-record certification. It states that it is hosted on Amazon Web Services with 256-bit encryption, that personal information is stored on servers in the USA, that it is GDPR compliant and that signed documents carry an audit trail and certificate. Check these against your own obligations before you start.
How do we make sure the right person signs?
Turn on the optional one-time passcode: QuoteCloud sends a code to the signer by email, and they enter it before they can sign. Each signer has their own signature block, nobody needs an account, and the completed document carries a certificate of authenticity and an audit trail. eSignatures are included on every plan.
Can we stop staff editing consent wording?
Yes, on the Business plan. Save the consent wording as a block in the content library and lock it: locked blocks can be added to documents but stay non-editable, and only admins or users with permission can unlock them. Version history, also on Business, keeps earlier versions of a document.
Does QuoteCloud store patients' card details?
No. Payments on signing go through Stripe or PayPal, and QuoteCloud does not store card details; its staff cannot access them. Payments are on the Essentials plan and above and need your own Stripe or PayPal account.
Can we control what each staff member can do?
Yes. Custom user roles and teams are on Essentials and above, with role permissions for content libraries and product categories that can be assigned to teams. Content locking and version history are on Business. Single sign-on and IP range filtering are on Enterprise.
More for health providers
Consent, intake and the rest of running QuoteCloud in a practice.
-
Consent, acknowledgements & multiple signersConsent wording in a locked block, acknowledgements ticked and every signer (patient, guardian or representative) signing online.Explore
-
Intake & referral forms inside the documentThe Forms block collects intake details in the same document the client signs, and can start your next step through Zapier.Explore
-
QuoteCloud implementation for health providersFee schedules loaded, estimate and agreement templates converted, consent wording locked and the team trained.Explore
- Treatment plans & cost estimatesThe plan, every fee line, what the estimate does not include and an expiry date, accepted and signed before treatment starts.
- Physio, OT & psychology programsSessions per week, the program schedule and a choice of program options, with the first fees paid on signing.
- Cosmetic & elective treatment quotesTreatment options side by side, a deposit to book, an expiry date and the patient's acknowledgements in one quote.
- Medical equipment & mobility quotesHire by the week or buy outright, delivery and set-up, product brochures as PDF pages, signed and paid online.
- In-home care & service agreementsWeekly or fortnightly services shown as repeating charges, a visit schedule, terms and an expiry date the family signs.
- Funded-plan service agreementsSupports, rates and a schedule set out for a participant and their nominee, with the agreement signed by both.
- Practice management & accounting integrationsSigned agreements to your practice system through Zapier or the API, and accounting native on Business.
- Healthcare templatesReal QuoteCloud templates for treatment plans, home care contracts, medical services and pharmacy agreements.
- FAQAnswers to the questions clinics, allied health, care providers and equipment suppliers ask most.
Check the facts, then send your first agreement
Free for 14 days. No credit card required.