Security
Patient data, protected.
Patient data security in clinic software comes down to everyday controls: who can see a record, what gets logged, and who must approve sensitive changes. This page lists the controls built into OctoMediCare, plainly and without claims we cannot back.
- Role-based access with fine-grained permissions
- Each clinic's data kept separate
- Append-only audit log
- Second-person approval for sensitive money actions
Audit log
Illustrative interface · append-only
-
Chart opened 10:04
Dr. Mariam K. · Visit G-021
-
Note finalized and locked 10:19
Dr. Mariam K.
-
Credit note requested 10:42
Cashier · Salmiya
-
Credit note approved 10:55
Finance manager
The risk
Most clinic data problems start inside the clinic.
Patient records and clinic finances are rarely exposed by something dramatic. More often it is a shared login, a missing log or a change nobody had to approve.
-
Everyone sees everything
A receptionist can open clinical notes, or a branch can see another branch's patients, because access was never narrowed.
-
No record of who did what
When a result is changed or an invoice is voided, there is no reliable trail showing who did it and when.
-
One person can move money alone
Credit notes, write-offs and payroll are approved by the same person who prepared them.
-
Sensitive details stored in full
Bank details and ID numbers sit in plain view in files and spreadsheets that are emailed around.
Access and accountability
Controls for who sees and changes patient data.
-
Role-based access
Fine-grained permissions decide what each role can see and do, from reception to finance.
-
Clinic data separated
In a multi-clinic setup, each clinic's data is kept separate from the others.
-
Append-only audit log
Actions are added to the log and never edited away, so the history stays intact.
-
Locked clinical notes
Doctors save drafts, then finalize and lock the note so it cannot be quietly changed later.
-
Signed, expiring file links
Shared files open through signed links that expire, rather than permanent public addresses.
-
Login protection
Repeated login attempts are rate limited, and accounts can be suspended when someone leaves.
Financial integrity
The same care for the clinic's money.
Financial records are part of your data security. OctoMediCare protects them with rules, not just good intentions.
-
Second-person approval
Journals, credit notes, write-offs and payroll need a second person to approve them.
-
Money stored to the fils
Amounts are stored to three decimals of the Kuwaiti dinar, never as rounded floating-point numbers.
-
Sequential document numbers
Invoices and other documents are numbered in sequence, so gaps and duplicates stand out.
-
Closed periods stay closed
Once a period is closed, its figures cannot be changed.
-
Encrypted bank IBANs
Staff bank IBANs used for payroll are stored encrypted.
-
Minimal ID storage
For HR documents, only the last four digits of ID numbers are stored.
Why it matters
Trust is built from small controls that always run.
Patients expect their records to be seen only by the people treating them. Owners expect the books to show what really happened. Both depend on access rules, logs and approvals that work the same way every day.
Because these controls are part of the system rather than a separate policy document, they apply in every branch and every department without relying on staff memory.
- Staff see what their job needs, not more
- Every sensitive action leaves a trace
- No single person can quietly move money
- Financial history that cannot be rewritten
Role permissions
Receptionist · Illustrative
- Allowed
Register patients
- Allowed
Take payments
- Not allowed
Read clinical notes
- Needs approval
Issue credit notes
What we do and don't claim
OctoMediCare does not claim formal security certifications. What we can show you are the controls on this page, working in the product. If your team needs more detail for an internal review, such as how access, logging and hosting are set up, request our security details and we will share them directly.
Frequently asked questions
Can we limit what each staff member sees in the clinic software?
Yes. Roles come with fine-grained permissions, so a receptionist, nurse, doctor or accountant only sees and does what you allow for that role.
Is our clinic's data separated from other clinics?
Yes. In a multi-clinic setup each clinic has its own data, ledger and brand, kept separate from the others.
Can someone delete a financial record to hide a mistake?
No. Journals are reversed rather than deleted, closed periods cannot be changed, and credit notes and write-offs need a second approval. Every action is kept in the append-only audit log.
Where is patient data hosted?
OctoMediCare can run in the cloud, on an on-premise server or in a containerized deployment. Our Kuwait team will go through the option that suits your facility.
Can we get security information for our IT or compliance review?
Yes. Request security details through our contact page and our team will share them with you.
Ask us the hard security questions.
Book a demo or request security details. We will show the access rules, audit log and approvals working on sample data, and answer your team's questions directly.
Call +965 5554 7992 · Developed in Kuwait. Supported locally.