Security
Your patients’ records, kept safe.
We protect your patients’ records the way we would want ours protected. This page says what we do today, and what we do not do yet.
How it works
What protects your data every day.
Encrypted records
Sensitive fields in patient records are encrypted when stored (AES-256-GCM). Data is sent over HTTPS.
Who can see what
Each staff role can only see and do what its permissions allow, at their own hospital.
A record of who read what
Each time staff open a patient's records, we record who, what and when. Admins can search that record.
Hospitals kept apart
Each hospital's data is kept separate from every other hospital's by the application on every request.
Sign-in
Staff sign in with their own account, with sessions that time out. Signing in with your hospital's own login system (SSO) is not available yet.
Standards
The rules we build to.
We have not been through an outside audit yet. Ask us anything about how we handle records.
USA
HIPAA
We build to the HIPAA rules for protecting health records. Ask us about a Business Associate Agreement.
Nigeria and Europe
NDPR and GDPR
We follow the Nigeria Data Protection Regulation and GDPR principles: collect only what is needed, and let people see their data.
Not done yet
Independent audits
We have not completed an independent security audit such as SOC 2 or ISO 27001 yet. We will say so here when we have.
Paperwork
The documents your procurement team will ask for.
BAA and data agreements
Ask us for a Business Associate Agreement or a data processing agreement. We will go through it with your team.
Security questionnaires
Send us your security questionnaire and we will answer it honestly, including what we do not do yet.
If something goes wrong
If a problem affects your hospital's data, we will tell you, explain what happened and what we are doing about it.
Questions about security?
Send us your security questionnaire, or book a short call. We will answer honestly, including what we do not do yet.