Every clinic's data is isolated, and isolation is enforced by the system
Isolation is not a condition a developer writes into every query and might forget once — it is a rule applied automatically to every read and write, with an automated test that walks every table and fails the build if one escapes it. And the default is that the absence of a clinic means **deny**, never allow.