Security and Privacy

Access Control

DokEMR uses role-based access so doctors, clinic admins, secretaries, med techs, rad techs, encoders, and support users see only workflows appropriate to their role.

Staff-login users are prompted to accept a Staff Privacy & Acceptable Use Notice covering confidentiality, account security, authorized access, and audit trail accountability.

Clinic administrators can deactivate users when staff leave, while preserving historical records and audit trails.

Auditability

Clinical and administrative actions are designed to leave traceable records such as issued-by details, revision trails, support activity, payment status changes, and patient audit entries.

Historical records should remain attributable even if a staff account is later deactivated.

Data Protection Practices

DokEMR uses secure sessions, password controls, subscription/action gating, server-side validation, document access controls, and operational logging to reduce common risks.

Clinics should also keep their devices, browsers, networks, and user access practices current and secure.

Your Data Stays Yours

Your clinic's data belongs to your clinic. The clinic administrator can export a complete copy at any time, on any plan, from Clinic Settings > Data Export: spreadsheets (CSV) for patients, visits, prescriptions, laboratory results, appointments and billing, plus the uploaded files and PDFs, with a README that explains every file.

An export needs the administrator's password, is built and kept in a private area that is not reachable from the web, is available for download only to that clinic's administrator for 7 days, is recorded in the audit trail, and triggers an email to the clinic's administrators. Passwords and other secrets are never included.

If a clinic cannot open its workspace or cannot make the export itself, DokEMR support will prepare one for the clinic at no charge.

Philippine Privacy Context

DokEMR is built for Philippine clinic workflows and is intended to support responsible handling of personal and sensitive personal information under the Data Privacy Act of 2012.

Clinics remain responsible for their own privacy notices, patient consents, staff training, access reviews, and other organizational obligations.