How access is controlled, how activity is recorded, and how the AI assistant is kept inside the same boundaries as everything else.
Permissions are defined per role and per module. Reception does not open clinical notes; the pharmacy sees the prescription and the allergy list, not the consultation narrative. Access follows the job.
Individual accounts for every staff member, with no shared clinic login. Sessions expire, and access can be revoked immediately when someone leaves.
A record is opened by people involved in that patient's care. What each role can see within it is configured by the clinic, not fixed by us.
Access to clinical documentation is recorded — who opened, edited, printed or exported which record, and when. Administrators can review that log.
Encryption in transit and at rest, scheduled backups with restore points, and separation between clinics on shared infrastructure.
The assistant works on the clinic's own record. It proposes rather than writes: nothing reaches a patient record without a person confirming it, and every substantive answer shows what it drew on.
Read the record of the patient currently open
Draft summaries, notes and documents for review
Show which parts of the record informed an answer
Stay inside the same role permissions as the user
Write to a patient record without confirmation
Make a diagnosis or choose a prescription
Release a laboratory report on its own
Move patient data outside the clinic's environment for training
HIPAA (US) — role-based access, audit logging and minimum-necessary access reflect the Security Rule's safeguard categories
GDPR (EU & UK) — data minimisation plus access, correction and deletion workflows built for data-subject requests
PDPL (Gulf region) — consent-led processing, with an on-premise deployment option for data-residency requirements
Audit trails record who saw and changed what — the evidence every framework above asks for
POPIA (South Africa) — accountability and processing-limitation principles shape storage and access
PIPEDA (Canada) — consent and openness principles govern how patient information is collected and disclosed
Australian Privacy Principles — access, correction and use-limitation expectations built into record-level permissions
Alignment is engineering, not certification — formal compliance depends on how your clinic deploys and operates the system
Regulatory requirements for clinical software vary by country and by the kind of practice you run. We do not list certifications on this page that have not been completed and independently verified for your jurisdiction.
During evaluation we will share our current certification status, data residency options, sub-processor list and a data processing agreement, and work through your own information-governance requirements with you.
Request our security documentation →We would rather answer them before you buy than after.