Data protection and security

Introduction

ProEmTech puts strong emphasis on data protection, security, confidentiality and reliability across DoctAssist and all its products and services.

As a healthcare technology provider, we keep security and data handling controls that match the sensitivity of patients' and clinics' information.

Scope

This policy covers all systems ProEmTech owns or manages, including DoctAssist, ProMed, ProMed UK, ProMed Insight AI, BoardUZZ, LabNetX, FeedUZZ, oNext, Anges, UrgenZ, and their infrastructure, modules, APIs, integrations, dashboards, mobile apps, reports, monitoring and support systems.

Ownership and control of technology

All platforms, software, cloud environments, source code, integrations and related technology remain the exclusive property of ProEmTech. Clinics get only a right to use the service under their subscription, not ownership or control of the underlying technology.

Secure infrastructure

DoctAssist runs on secure infrastructure designed for:

• confidentiality
• integrity
• availability
• access control
• reliability
• monitoring
• backups and resilience
• incident awareness
• continuity of service

Infrastructure may be run by ProEmTech directly or by carefully chosen authorised providers under suitable controls.

Confidentiality

We treat clinic and patient data as confidential. Each clinic's data is kept apart and is never shared with other clinics or organisations.

We do not use one clinic's data as a shared pool for another unless expressly authorised, legally required or technically necessary under an agreed, lawful arrangement.

Access control

Access to systems and data is limited to authorised people and roles with a real need. In DoctAssist, each clinic decides who has access and with which role (doctor, receptionist, administrator). We use authentication, role-based access, administrative review and monitoring to reduce the risk of unauthorised access.

Security measures

Our measures include:

• sign-in with one-time codes and authentication controls
• access restrictions
• encryption in transit
• logging and monitoring
• patching and maintenance
• hardened systems
• backups
• administrative safeguards
• controls on our vendors
• review of and response to security events

How we handle data

Our approach rests on:

• confidentiality
• least necessary access
• controlled administration
• processing only for a clear purpose
• accountability
• lawful handling under our agreements
• keeping each clinic separate

Incidents

We keep processes to find, review, contain and respond to security incidents, disruptions, vulnerabilities and suspected unauthorised access. The response depends on the nature, severity and legal implications of each incident.

Compliance

This policy follows the principles of:

• the UK GDPR
• the EU GDPR
• India's Digital Personal Data Protection Act, 2023
• the confidentiality, access control and responsible operation expected of healthcare software services

How we use personal data is explained in our Privacy policy.

Continuous improvement

We review and improve our security and data protection practices as the service grows, as clinics need, as the law changes and as risks change.

Contact

ProEmTech Infosystems Private Limited, Focus 1, 310, Outer Ring Rd, HRBR Layout 3rd Block, HBR Layout 4th Block, Kalyan Nagar, Bengaluru, Karnataka 560043, India. info@proemtech.com