Keeping Patient Data Safe: Security Features Inside Got2

How our platform protects your practice, your patients, and your peace of mind.

Running an optical practice means handling some of the most personal information your patients will ever share with you: medical histories, prescription records, referral letters, payment details, and NHS or insurance claims. A single data breach doesn't just cost money — it erodes the trust that keeps patients coming back year after year.

At got2 eyecare we took security seriously from day one. Got2 Software is built to give independent optical practices a mature, continuously maintained security foundation that most bespoke practice management systems simply can't match. On top of that foundation we have layered advanced login controls specifically designed for multi-location practices and small teams who share workstations.

Here is a plain-English walkthrough of what's protecting your practice every day.

Built for Healthcare from the Ground Up

Most practice management platforms bolt security on as an afterthought. got2 eyecare was designed specifically for clinical environments where patient data is regulated, audited, and — most importantly — trusted. Before we get into the individual features, here are the four pillars that underpin everything else.

HIPAA Compliance

got2 eyecare is built from the ground up to support secure, HIPAA-compliant clinical workflows. That means the way patient data is stored, accessed, transmitted, and logged meets the standards set out by the Health Insurance Portability and Accountability Act — standards that also map closely onto UK and EU healthcare data obligations. Whether your practice uses patient portals, eFaxing, or electronic referrals, those workflows are designed with HIPAA's Privacy and Security Rules in mind at every step.

Cloud Infrastructure

Patient data stored on a server under the reception desk is a physical security risk — theft, flood, fire, or a failed hard drive can wipe years of records overnight. got2 eyecare runs on highly reliable, cutting-edge cloud infrastructure, which eliminates the need for vulnerable on-site hardware entirely. Your data is redundantly stored across multiple availability zones, maintained by infrastructure teams whose full-time job is uptime and security patching, and accessible from any authorised device the moment you need it.

Role-Based Access Control

Access to sensitive patient Protected Health Information (PHI) is restricted based on each team member's role in the practice. A receptionist can book appointments and process payments; they cannot view clinical examination records. An optometrist can read and write to patient charts; they cannot access payroll data. These boundaries are enforced by the software, not by trust — so there's no way for someone to accidentally (or deliberately) see data they shouldn't.

Not everyone in your practice needs to see everything. A front-of-house receptionist booking appointments doesn't need access to supplier invoices. A dispensing optician fitting frames doesn't need to edit clinical records. Got2 Software's groups and access rights system lets you define exactly what each role can see, create, edit, or delete — right down to individual fields on a record.

Got2 ships with pre-configured roles that match the way optical practices actually work: receptionist, optometrist, dispensing optician, practice manager, and owner. You can tighten or relax any of them without touching a line of code.

Audit Trails

Every view, change, and update made to a patient chart or record is tracked and timestamped with the name of the user who made it. If a record is queried during an inspection, a complaint, or a data subject access request, you can produce a complete, accurate history of exactly who accessed or modified it and when. This level of accountability is expected by regulators and increasingly required by indemnity insurers.

Two-Factor Authentication (2FA)

Passwords get shared, guessed, and phished. Two-factor authentication (2FA) adds a second check — a time-limited code from an authenticator app — so that even if a password is compromised, an attacker still can't get in. Got2 Software supports TOTP-based 2FA for every user account, and practice managers can enforce it as mandatory so no one can opt out.

Strong Password Policies

Got2 Software lets you enforce minimum password length, complexity requirements, and expiry periods from the Settings panel. Staff who haven't changed their password in 90 days can be prompted automatically — no manual chasing required.

API Keys and Secure Integrations

When got2 eyecare connects to third-party services — optical lab ordering systems, NHS Spine, frame supplier catalogues — those connections use scoped API keys rather than user passwords. Each key can be revoked instantly without touching anyone's login credentials, and each one carries only the permissions it actually needs.

HTTPS Everywhere

All data in transit between your browser and the got2 eyecare server is encrypted with TLS. Patient records, prescription data, and payment information never travel across the internet in plain text.

Database-Level Encryption and Backups

Got2 Software stores data in an enterprise-grade database with encryption at rest. got2 eyecare deployments include automated daily backups with point-in-time recovery, so even in a worst-case scenario — ransomware, hardware failure, accidental deletion — your patient records can be restored.

Audit Trails on Critical Records

Every change to a patient record, a clinical note, or an invoice in got2 eyecare is logged with a timestamp and the name of the user who made it. Regulators and indemnity insurers increasingly expect this level of accountability, and Got2 Software provides it out of the box through its built-in activity and change log system.

Advanced Login Security: Controlling Who Can Log In, From Where, and When

The features above protect data once someone is inside the system. But some of the most important security questions are about who gets in at all.

For optical practices with multiple locations, remote staff, or shared reception computers, those questions get complicated fast:

• What happens if a member of staff logs in from home on an unsecured personal device?
• What if someone's credentials are used at 2 a.m. from a country you've never done business with?
• What if a departing employee's login is still active on their personal laptop?

got2 eyecare addresses these risks with an Advanced Login Security module that adds the following layers on top of Got2 Software's foundation.

Location-Based Login Rules

You can define rules that allow or deny access based on IP address or IP address range. In practice this means you can:

• Whitelist your practice network so that clinical records can only be accessed from within the building.
• Whitelist your VPN range so that authorised remote workers still have access.
• Block all other origins by default — if an IP doesn't match any rule, access is denied.

Rules are evaluated in sequence order, so you can build nuanced policies: allow the practice's static IP at any time, allow the owner's home IP only during business hours, deny everything else.

Time-Based Access Windows with Weekday Controls

Each location rule can be combined with a time window and day-of-week restrictions. For example:

• Staff logins are allowed Monday to Friday, 08:00–19:00.
• The practice's IP is allowed Saturday, 09:00–17:00.
• No logins are permitted on Sundays or bank holidays.

This dramatically reduces the window during which stolen credentials can be exploited. A password obtained on a Friday afternoon is useless until Monday morning — and by then you've reset it.

One-Time Email Code for New Locations

Even with location rules in place, you may occasionally need legitimate access from a new device or location — a locum optometrist, a practice manager working from a conference. Rather than disabling protection, the system sends a six-digit verification code to the user's registered email address the first time they log in from an unrecognised IP.

Once they enter the code successfully, that IP is remembered and future logins from it go straight through. It's the same principle used by your online banking — unfamiliar locations get a second check; familiar ones don't.

Every verification attempt is logged with its outcome, so you have a complete record of where each user has authenticated from.

Brute Force Protection

Automated password-guessing attacks (credential stuffing) are increasingly common even against small businesses. The system counts failed login attempts per IP address and per user account. When the threshold is crossed — five failures within thirty minutes, for example — that IP or account is automatically blocked for a configurable cooldown period.

Active blocks are visible in the admin dashboard with a one-click Unblock button for legitimate lockouts (a staff member who forgot their password). Security alert emails can be sent to the practice owner or IT contact whenever a block is triggered, so you know immediately when something suspicious is happening.

Single Session Enforcement

got2 eyecare can be configured so that each user account can only have one active session at a time. When a user logs in from a new device, their previous session is immediately invalidated. This closes the gap where a session left open on an unattended shared computer could be used after the person has left the building.

Temporary Access Passes for Locums and Visitors

When a locum optometrist or visiting auditor needs access for a defined period, you can issue a temporary access pass: a time-limited grant with a recorded reason and automatic expiry. No need to create a permanent user account, weaken your location rules, or remember to revoke access manually when the visit ends. The pass expires at the date and time you set, and usage is counted so you can see exactly how many times it was used.

Complete Login History

Every login attempt — successful or not — is recorded in a searchable audit log showing the date, time, IP address, user account, outcome (success, wrong password, blocked by rule, OTP pending, etc.), and browser. The log is automatically purged after your configured retention period to avoid unnecessary data accumulation.

Practice managers can filter by user, IP address, or outcome, and view a bar chart of login activity over time. If something looks wrong, the data to investigate it is already there.

Per-User Security Profiles

Individual user accounts in got2 eyecare have a Login Security tab where administrators can:

• Enable or disable security checks for that specific user.
• Grant a full bypass to senior administrators who need unrestricted access.
• View the user's known (previously verified) IP addresses and remove any that are no longer trusted.
• See the user's last login IP and date at a glance.

UK GDPR and ICO Expectations

Under UK GDPR, practices are required to implement "appropriate technical and organisational measures" to protect personal data. The ICO's published guidance specifically calls out access controls and audit logging as expected controls. The features described above are direct, demonstrable responses to those expectations.

CQC Registration

Practices regulated by the Care Quality Commission (CQC) are expected to demonstrate that access to clinical records is controlled and monitored. A complete, searchable login audit log and role-based access controls are exactly the kind of evidence that satisfies a CQC inspection.

Cyber Essentials

Cyber Essentials certification — increasingly required by NHS contracts and cyber insurers — explicitly requires boundary firewalls, access control, and patch management. Location-based login rules and brute force protection directly address the access control requirements of that scheme.

The Human Factor

The biggest security risk in any practice isn't software — it's people. Staff share passwords. Former employees' accounts sometimes stay active. Someone clicks a phishing link. The security features built into got2 eyecare are designed to limit the damage when human error happens, not just to prevent the perfect attack.

Get Started for Free

Got2 eyecare software is completely free to get started. There are no upfront costs, no lengthy contracts, and no reason to put it off. You can have your practice up and running — with all of the security features described in this article enabled — in a matter of hours.

Head to got2.care to create your free account today.

If you're already using got2 eyecare, the Advanced Login Security features are ready to configure from Settings → Login Security. We recommend starting with:

1. Enabling brute force protection (takes 30 seconds to switch on).
2. Enforcing 2FA for all user accounts.
3. Adding your practice IP addresses to a location allow rule.
4. Enabling OTP verification for new locations.

If you'd like help configuring security settings for your practice, our support team is on hand — just reach out via got2.care.

Security features described in this article include Got2 Software core functionality and the Advanced Login Security module. Specific configuration options may vary depending on your deployment.