Trust & Security
Trust is architecture, not a promise.
Every action accountable. Every record protected. Every control written down and tested — built for Iraq, and running here.
Every control below is built, tested across more than 18,000 automated tests, and written down in an evidence folder kept with the code.
Security architecture
Every control, enforced in code — not in a policy no one reads.
RBAC + ABAC — role × context
Access decisions combine six dimensions: role, organization, employee credential, patient consent, data category, and purpose. A doctor outside a care relationship is blocked even with the right role.
Append-only audit trail — 535 event types
Every sensitive action writes a permanent, tamper-evident log entry: who acted, which role and organization, which resource, what changed, IP, device, timestamp, and purpose. 535 distinct event types are registered and tested. No one can quietly look at a record and disappear.
Consent enforced on every read
The clinic records the patient's consent per provider and per purpose, from the signed form. A provider without active consent is blocked from the record — and every consent change is itself logged.
Encrypted Identity Vault
National ID numbers, passports, civil-status IDs, and refugee certificates live in an isolated vault schema — separated from medical records, encrypted at rest, with every single access individually logged. A breach of the medical layer cannot expose identity documents.
The rule for AI, before any AI
There is no AI in the platform today. When it comes, it will only assist — summarise, flag, translate — and a person approves. It will never diagnose, prescribe, approve results or override consent.
Separation of duty
Across prescription, lab and radiology workflows, the person who enters a sensitive record is not the one who approves it. Entering a lab result and releasing it take two credentialed people — unless the lab has declared itself a one-person service, and then every result it releases says so.
FHIR R4 interoperability
Patient data, prescriptions, lab results and radiology reports are modeled against HL7 FHIR R4 — the international standard for healthcare data exchange — so a patient's history can move to another system without being typed again.
Written down, not claimed
An evidence folder is kept with the code — architecture diagrams, data flows, the permission matrix, the audit policy, security controls, test reports and the incident-response plan — and much of it is generated from the code itself, so it does not drift from what runs.
Automated safety sweeps
Scheduled checks watch credential and licence expiry. Once a professional licence has expired, that person can no longer open an encounter, sign a radiology report or dispense until it is renewed; a pharmacy whose facility licence has expired cannot dispense.
Engineered to be inspected.
Questions about security
What patients and inspectors ask us most.
Who can see my medical records?
Only providers with an active care relationship and your consent. Every access is permanently logged, and your clinic can show who accessed your records, when and why.
What if a doctor needs my records in an emergency without my consent?
Emergency break-glass access is permitted but never silent. Every break-glass event requires a documented reason, creates an elevated audit-log entry, and is reviewed by the platform administrator.
Can a pharmacist change my prescription?
No. The platform enforces this in code. A pharmacist can fulfill, reject, request clarification, or suggest an approved alternative. Editing a prescription is a hard block, not a warning.
Are my government ID documents stored securely?
Yes. National ID numbers and identity documents are stored in an isolated, encrypted Identity Vault — separate from your medical records. Every access to the vault is individually logged and classified as Highly Restricted data.
What is FHIR R4 and why does it matter?
HL7 FHIR R4 is the international standard for healthcare data exchange. It means your data is structured in a format other health systems can read, so your history can move with you without being typed again.
How can someone check how the platform works?
An evidence folder is kept with the code and updated as it changes — architecture diagrams, audit policies, the permission matrix, test reports and the incident-response plan. We will walk anyone reviewing the platform through it, in Arabic or English.
What does “append-only audit log” mean?
It means audit records can be added but never edited or deleted — not even by an administrator. This tamper-evident design ensures the record of who accessed what cannot be quietly erased after the fact.
Does the AI access my data without permission?
No — there is no AI in the platform today. When it comes, it will see only what the person asking may see, what it does will be recorded with the model and the data used, and a person will approve. It will never diagnose, prescribe, approve results or override consent.
Want the full security overview?
Request a walkthrough of the architecture, the audit model and the evidence folder — in Arabic or English.
Request the security overview