The audit log
Every save, every export, every refused attempt and every AI call writes a row through one writer — encounter.saved, prescription.changed, claims.exported, scribe.note_generated, auth.scope_denied, audit.exported are real event names — with a UTC timestamp, a machine code and a sentence, the actor and their role, the IP and user agent; reading a chart passes a permission gate but is not itself recorded, the log is an ordinary table (not tamper-evident), nothing purges it, and only your clinic's rows are ever in the query.
2705
What writes a row
Every write, every export, every denied attempt and every AI call — including the export of the audit log itself. The authentication family is enumerated (login success, failure, lockout, blocked, permission denied, logout); other families are added alongside the guards that raise them. A row carries a timestamp written by the database in UTC, a dot-namespaced action code and up to 2,000 characters of readable detail, the user and their email and role at the time, and the client address and browser.
What does not
Opening a chart passes a permission gate — nine of them in the encounter screen alone — and passing a gate does not write a row. Downloading an encounter attachment is not logged either. Better to learn that here than in a privacy review.
Discipline, not a guarantee
It is an ordinary table in an ordinary database: one thing writes to it and nothing in Qlynic edits it, but there is no tamper-proof chain, no append-only storage and no write-once media. The write is wrapped so a failure in the log can never stop the action it was logging — which also means capture is not guaranteed. A rolled-back action never reaches your dashboard.
Scope, readers, retention
The clinic id is in the query, not a filter a reader chooses, so no view spans clinics. Owners and Admins can read it. There is no retention timer: how long you keep your record of access is your decision under the HIA, not a vendor default — and that is the absence of a purge, not a promise of permanence.
Where to look