See the patient journey
Security & compliance
Patient records, protected by design.
Built for the rules GCC clinics work under: NHRA in Bahrain, Ministry of Health requirements across the region, and personal data protection law. Here is how Aafia keeps patient records safe.
Compliance
What each badge means for your clinic.
NHRA
Bahrain · National Health Regulatory AuthorityAafia is designed to align with NHRA standards for healthcare facilities in Bahrain, featuring an e-prescribing module that utilizes the official NHRA drug catalogue.
Ministry of Health
Saudi Arabia and OmanBuilt around Ministry of Health requirements, Aafia delivers comprehensive clinical security with native digital consent records and an unalterable audit trail embedded into every patient file.
PDPL ready
Personal data protection lawE-signed consent in Arabic or English, and audit trails that support personal data protection law.
Access by role
Everyone sees what their job needs. Nothing more.
Roles and permissions decide who can view or change each part of a patient's record. Pick a role to see an example setup.
Example setup. Permissions are set per clinic. In Aafia you choose, per part of the record, who can view and edit, view only, or not see it at all.
- 10:28 Noora S.Billing Created INV-30412Edit
- 10:26 Ali R.Pharmacist Dispensed RX-8812Edit
- 10:24 Dr. KhalidDoctor Signed RX-8812Sign
- 10:22 Maryam H.Nurse Recorded vitalsEdit
- 10:20 Huda A.Reception Updated phone numberEdit
Sample activity. Changes only: what was recorded, signed or changed, and by whom. Opening a record is not logged.
Audit trail
Every change, on record.
Who recorded vitals, signed a prescription or a consent form, or changed a patient's details, and when.
For your IT team
Where the data lives and how it is kept.
The details IT and compliance teams ask for, in one place.
Hosting
Where patient data is stored and processed.
Your choice of where it runs. Use Aafia managed cloud, or install it on your own server or on-premises, so data stays in your clinic or country.Encryption
How data is protected while moving and while stored.
Protected in transit. All connections use HTTPS (TLS). Stored data is encrypted at rest.Backups
How often data is backed up.
Automatic backups. Managed cloud: daily backups, kept for 30 days. On-premises: backups follow your IT policy, and we help you set them.Availability
How reliably the service is up during clinic hours.
Built for clinic hours. Managed cloud: 99.9% uptime target. On-premises: depends on your own server and network.Staff access
Who at Aafia can reach customer data, and when.
Limited, and only when needed. On managed cloud, Aafia support accesses data only to help you. On-premises, your data stays inside your network.Export & deletion
Taking your data with you, or having it removed.
Your data stays yours. Export it in standard formats such as CSV and PDF at any time. If you leave, we delete your data from our servers within 30 days and confirm in writing.Questions
Asked by IT and compliance teams.
Only the people you allow. Each member of staff has a role, and the role decides which parts of a patient's record they can view or change. You set roles and access for your clinic, across all your branches.
Yes. Aafia is designed to align with NHRA standards for healthcare facilities in Bahrain, featuring an e-prescribing module that utilizes the official NHRA drug catalogue.
Aafia is PDPL ready: patients sign consent forms electronically, in Arabic or English, and the audit trail on every patient file records who changed what, and when.
On the managed cloud, nothing. Aafia runs in the browser on any computer or tablet, with no software or server for your clinic to look after. On-premises, your team prepares your own server and we install Aafia on it, included in your plan — your staff still just use a browser.
Security updates and new features are applied automatically, at no extra charge — on the managed cloud and on-premises alike.
Your choice: the Aafia managed cloud, or install it on your own server or on-premises, so data stays in your clinic or country.
Yours. Your data stays yours: export it in standard formats such as CSV and PDF at any time.
Yes. All connections use HTTPS (TLS), and stored data is encrypted at rest.
Yes. We sign a data processing agreement if it is required.
Export your data at any time in standard formats such as CSV and PDF. If you leave, we delete your data from our servers within 30 days and confirm in writing.
Have more questions about security?
Our team can walk your IT and compliance leads through it.