Skip to content
ZenOptix

Security & GDPR

Designed for sensitive optical practice data

ZenOptix is built around controlled access, auditability and secure handling of patient, clinical and practice information.

Book a demo

Principles

Security principles built into the product

These principles shape how every ZenOptix module is designed, not added afterwards.

Least-privilege access

Users should only access what their role and context allow.

Organisation and branch context

Access is shaped by the organisation and location the user is working in.

Audit-focused design

Sensitive activity should be recorded and reviewable.

Controlled support

Support access should be deliberate, limited and auditable.

Privacy-aware workflows

Exports, files and patient data require careful handling.

Access Control

Role-based access for real practice teams

ZenOptix supports different team roles across platform, organisation and branch contexts, helping practices control who can access operational, financial and clinical areas.
Platform admins Organisation admins Location managers Receptionists Optometrists Locums Dispensing users Stock users Finance users Auditors

Menus are not the security boundary. Route and action permissions must still be enforced by the application. ZenOptix is designed so that hiding a screen is never the only protection.

User Access · Example

Two-Factor Sign-In

Two-factor sign-in for every account

Every member of staff signs in with their password and a code from an authenticator app on their phone, so a stolen password alone is not enough to get in. It is required for all staff, not optional.
  • Set up on first sign-in Every account sets up two-factor sign-in the first time it is used, so no account works on a password alone.
  • Backup codes Each person gets one-time backup codes for when their phone is not to hand.
  • Trusted computers A computer can be trusted for up to 30 days. The practice can shorten this to 7 days, or require a code every time.
  • Lost phone reset A practice owner or manager can reset two-factor after confirming it is really them. The reset is recorded and the person is emailed.

Auditability

Auditability for sensitive actions

ZenOptix is designed to record important activity across patient records, clinical visits, appointment changes, reports, exports, till activity, staff changes and support access.
  • Patient viewed or updated
  • Clinical visit signed or amended
  • Appointment booked, moved or reassigned
  • Report viewed or exported
  • Till payment or refund recorded
  • Staff roles or permissions changed
  • Support session started or ended

Patient Data

Careful handling of patient records, documents and images

Optical practices handle sensitive patient and clinical information. ZenOptix is designed to organise records, documents and images with controlled access and clear activity history.

Patient timeline

Activity organised around a clear history.

Clinical visit separation

Clinical records kept distinct and structured.

Documents and images

Structured, access-controlled storage.

Controlled exports

Exports are deliberate and visible.

Signed records and amendments

Changes are controlled and traceable.

Support Access & Account Security

Support access is controlled, and accounts are protected

Support never has standing access to a practice. Access is time-limited, needs the practice's approval and is fully audited. Staff accounts are protected by two-factor sign-in, a password policy and account security controls, and security health checks run across the platform.

Two-factor sign-in for all staff

Every staff account needs a password and a code from an authenticator app.

Practice approval required

Support access needs the practice's approval. There is no standing access.

Time-limited

Approved access is scoped and time-limited, never open-ended.

Fully audited

Support access is fully audited.

Password policy

A password policy and account security controls protect every staff account.

Security health checks

Security health checks run across the platform.

Role-based access

Access is shaped by each person's role and branch.

GDPR

GDPR-aware by design

ZenOptix is designed to support privacy-aware practice workflows, including controlled access, data exports, retention decisions and audit trails.

Access control

Role and context shape what each user can reach.

Audit trails

Sensitive activity is designed to be reviewable.

Export visibility

Data leaving the system should be deliberate and visible.

Retention support

Designed to support considered retention decisions.

Opt-out preferences

Patient communication preferences are respected.

Data protection workflows

Privacy-aware handling built into daily tasks.

Subject access requests

SAR and data protection requests handled as a tracked workflow.

Patient portal visibility

Records reach the portal only when the practice shares them.

UK data residency

Practice and patient data is hosted in the United Kingdom.

Hosting & Transparency

Hosted in the UK, with nothing hidden from the practice

Where your data lives, who can reach it and what it costs to run should all be answerable without asking us. ZenOptix is built so a practice manager can check each of those things in the product.

UK-based hosting

ZenOptix runs on UK-based infrastructure. Practice and patient data stays in the United Kingdom.

Per-branch data isolation

Multi-branch practices switch context between branches, with data kept separated by branch.

Data protection requests

Subject access and data protection requests are handled as a built-in workflow rather than an ad hoc scramble.

Support access you approve

Support access requires practice approval, is time-limited and is fully audited.

Billing you can see

Invoices, payments and your plan are visible in the practice billing portal, with accounting exports for your bookkeeper.

SMS allowance transparency

Message usage, bundles and thresholds are visible in the app, so messaging costs are never a surprise.

Evidence-based communication

Clear, evidence-based security communication

ZenOptix communicates security and assurance capabilities according to their implemented and verified scope. Review the principles behind the workflows:

  • Role-based access shaped around team responsibilities
  • Branch context and least-privilege access principles
  • Controlled support access with reviewable activity
  • Audit-focused design and privacy-aware workflows

Request the security and data-processing documentation relevant to your practice before onboarding.

See it in your practice

Want to understand how ZenOptix controls access?

Book a demo and we'll show how roles, branch context and audit-focused workflows are designed into ZenOptix.

Book a demo