Security and data protection.
Laboratory results are health information, among the most sensitive data there is. This page explains how ClinisLab protects it, and who is responsible for what.
Controls in place today
Isolation between labs
Every record belongs to one lab, and the database itself refuses to return another lab's rows (PostgreSQL row-level security), in addition to checks in the application.
Individual accounts and roles
No shared logins. Each person's access follows their role, and administrators can see and change roles at any time.
Two-factor sign-in
Administrators and staff who validate results must use an authenticator app. Sessions expire after inactivity.
Brute-force protection
Repeated failed sign-ins lock the account temporarily and are recorded; password reset links expire quickly.
Tamper-evident audit log
Sign-ins, configuration changes and administrative actions are recorded in an append-only, hash-chained log, so any later alteration is detectable.
Encrypted connections
All traffic uses HTTPS. Sensitive secrets such as two-factor keys are additionally encrypted in the database.
Ghana's Data Protection Act
Under the Data Protection Act, 2012 (Act 843), your lab is the data controller for your patients' information: you decide what is collected and why. ClinisLab is your data processor: we store and process it only on your instructions, to run the service.
Each customer lab signs a data processing agreement with us, covering confidentiality, security, use of sub-processors, breach notification and the return or deletion of data at the end of the contract.
Being worked on
- Independent penetration test before general availabilityPlanned
- Documented backup restore drillsPlanned
- Self-service export of your lab's dataPlanned
- Published list of sub-processors and hosting locationsPlanned
Reporting a security issue
If you believe you have found a security problem, please tell us privately at [email protected] and do not access data that is not yours. We will acknowledge your report and keep you informed. See also our privacy notice.