Security and Privacy

Access Control

DokEMR uses role-based access so doctors, clinic admins, secretaries, med techs, rad techs, encoders, and support users see only workflows appropriate to their role.

Staff-login users are prompted to accept a Staff Privacy & Acceptable Use Notice covering confidentiality, account security, authorized access, and audit trail accountability.

Clinic administrators can deactivate users when staff leave, while preserving historical records and audit trails.

Auditability

Clinical and administrative actions are designed to leave traceable records such as issued-by details, revision trails, support activity, payment status changes, and patient audit entries.

Historical records should remain attributable even if a staff account is later deactivated.

Data Protection Practices

DokEMR uses secure sessions, password controls, subscription/action gating, server-side validation, document access controls, and operational logging to reduce common risks.

Clinics should also keep their devices, browsers, networks, and user access practices current and secure.

Philippine Privacy Context

DokEMR is built for Philippine clinic workflows and is intended to support responsible handling of personal and sensitive personal information under the Data Privacy Act of 2012.

Clinics remain responsible for their own privacy notices, patient consents, staff training, access reviews, and other organizational obligations.