The boring details that make this safe.

Multi-tenant by construction, not by convention

Every clinical row in our database carries a tenant_id. Every query filters by it through a database-layer filter that cannot be bypassed by application code. New developers cannot accidentally write a query that crosses tenants, because the framework will refuse to execute it. We run an automated isolation test on every deploy that proves it: tenant A logs in, tenant B's data must not appear in any list, search, or report.

Roles that match how your clinic actually works

Six built-in roles — clinic admin, doctor, operator, pharmacist, lab tech, and read-only auditor — each with explicit permissions. A pharmacist can dispense but not prescribe. A lab tech can release results but not change them after a doctor has seen them. An operator can book appointments but cannot read clinical notes.

An audit log that you can actually read

Every patient record open, every encounter edit, every prescription, every lab release, every role change — logged with who, what, when, and from where. Clinic admins see it in a searchable UI. The log is append-only and cryptographically chained, so tampering is detectable.

Data lives in UAE North

Azure UAE North is the closest big-cloud region to Pakistan — about 7 ms from Karachi, 12 ms from Lahore. Your data does not leave that region without your explicit, written permission. Backups stay regional. The provider is Microsoft Azure; ours is the only software running in our subscription.

Encrypted in transit. Encrypted at rest. Separately key-protected for the sensitive bits.

TLS 1.3 everywhere, no exceptions. Database storage encrypted with platform-managed keys. CNIC, phone, address, and the audit log itself encrypted at the field level with a key we hold separately from the database, so a stolen backup is not a stolen patient list. JWT signing keys are 2048-bit RSA, rotatable on demand.

2FA for the people who matter; session timeout for everyone

TOTP-based 2FA (Google Authenticator, Authy, 1Password) is mandatory for doctors and clinic admins from day one. In Phase 2 we extend it to operators, pharmacists and lab techs. Every workstation has a configurable session timeout — the front desk's session does not stay open through the night.

Backed up daily. Restore-tested monthly.

Daily backups for every tenant, retained 30 days. Hourly point-in-time recovery for the Hospital tier, retained 7 days. A backup that is never restored is a backup that does not exist — we run a full restore drill monthly and a partial drill weekly, into an isolated environment.

Where Pakistan's data law lands, we land

There is no settled health-data privacy law in Pakistan today. The Personal Data Protection Bill is in motion. We have designed for what mature jurisdictions require — encryption, audit, breach notification, data residency, right to export — so that when the law settles, our compliance burden is paperwork, not engineering.