Health-adjacent and regulated-adjacent builds: what the defaults buy you.
Updated
Clinics' operational tooling, wellness practices, anywhere the records are about people and the default must be private. Grants: records, customers, forms, calendar, team, email, logs — and often little else: a smaller surface is a smaller audit.
// record type: intake
{ "fields": [
{ "name": "reason", "type": "select", "options": ["consult", "follow-up"], "filterable": true },
{ "name": "history", "type": "longtext" }, // encrypted, never indexed
{ "name": "consent", "type": "signature", "required": true },
{ "name": "documents", "type": "file" }
]}
The dashboard lists by status and reason (indexed scalars); the substance of the record never exists in plaintext at the database layer.
The platform provides the controls; it does not make compliance claims on your behalf. Regulatory posture (HIPAA, state privacy law, professional rules) is a property of your whole operation — agreements, training, front-end handling, subprocessors — not of any backend alone. Treat this section as the technical-controls half of that conversation, and bring your own counsel for the rest.