Security and data protection

We list only what exists. We show no certificates we do not hold.

Center data isolation
Each center's data is isolated inside the database itself, so one center never sees another's.
Permissions by role
Reception, doctor, accountant and owner each get only what they need.
Two-step sign-in
Optional per account, with an authenticator app and backup codes.
Audit log
Every important change is logged with who made it and when.
Passwords and links
Passwords are stored hashed (Argon2id); invite and reset links are single-use and time-limited.
Private files
Documents and receipts open only through short-lived signed links.
E-invoicing (ZATCA)
Tax invoices with a QR code, signing and submission to the authority, and an onboarding path for each center.
Patient data
Patients can ask to delete their portal account, and the medical file is kept as the rules require. The compliance details are in the privacy policy, under legal review.
Hosting
The hosting plan is inside the Kingdom (Riyadh). We confirm the final hosting provider and where message data goes before commercial launch.

This page is a placeholder outline. The final text is added after a lawyer reviews it; do not rely on it before then. Privacy policy

Ready to run your center on one system?