Session cookie, HTTPS via reverse proxy recommended for remote access. Health data stays on your server.