Enterprise-grade security,
built for African healthcare.

1. Infrastructure & Location

All Doctor's Bench EHR data — including patient records, session notes, practitioner accounts, and billing data — is stored on cloud infrastructure physically located within the Republic of Kenya. This satisfies both our own security principles and the data localisation intent of Section 50 of the Kenya Data Protection Act 2019.

2. Encryption

3. Access Controls

Access to patient data is governed by a role-based access control (RBAC) model consistent with the HIPAA Minimum Necessary standard (§164.502(b)):

Two-factor authentication (2FA) is available for all accounts and is mandatory for Clinic Admin and Supervisor roles. Automatic session timeout occurs after 30 minutes of inactivity, consistent with HIPAA §164.312(a)(2)(iii).

4. Audit Logging & Monitoring

We maintain comprehensive, immutable audit logs for all access events, consistent with HIPAA's Audit Control standard (§164.312(b)) and NIST SP 800-92:

• Every login attempt (successful and failed), with timestamp and IP address
• Every access to a patient record, including the record accessed and the accessing user
• Every data export or download event
• Every Smart Notes draft generation, approval, and rejection event
• Every account configuration change
• Every administrative action by Convo Africa staff

Audit logs are stored separately from operational databases and cannot be altered or deleted by any user, including administrators. Automated anomaly detection alerts our security team to suspicious patterns — such as bulk data access, logins from unusual locations, or multiple failed authentication attempts — in real time.

5. Backup & Disaster Recovery

• Backup frequency: Full database backups daily; incremental backups every 6 hours
• Backup encryption: All backups encrypted with AES-256, separate keys from primary data
• Backup location: Geographically separate, Kenya-based secondary data centre
• Backup testing: Restore tests conducted monthly; full DR simulation conducted bi-annually
• Recovery Time Objective (RTO): <4 hours for critical patient data
• Recovery Point Objective (RPO): <1 hour (maximum data loss window)
• Retention: Backups retained for 30 days before secure deletion

6. Secure Development

• OWASP Top 10: All development follows OWASP secure coding guidelines, with mandatory security review for all code changes affecting patient data
• Penetration testing: External penetration tests conducted bi-annually by independent security firms; critical findings remediated within 48 hours
• Dependency scanning: Automated scanning for vulnerable dependencies in CI/CD pipeline; high-severity CVEs patched within 24 hours
• Secrets management: No credentials stored in source code. All secrets managed through a dedicated secrets management system with access logging
• Staging environment: All changes tested in a fully isolated staging environment using synthetic (not real patient) data before production deployment

7. Smart Notes Security

Smart Notes processes session content to generate draft clinical notes. The following specific security measures apply to AI-assisted processing:

• Ephemeral processing: Session data passed to the Smart Notes engine is processed in an isolated, ephemeral container. No data is retained by the AI processing layer after the draft note is returned to the practitioner.
• Encrypted in transit: All data passed to and from the Smart Notes engine is encrypted with TLS 1.3. The processing environment is isolated from the general internet.
• Draft expiry: Unapproved Smart Notes drafts are automatically and permanently deleted after 72 hours. They are not accessible by any other user or system.
• No model training on PHI: Patient health data is not used to train, fine-tune, or evaluate AI models without separate, documented opt-in consent from the practitioner and patient.
• Audit trail: Every Smart Notes generation, approval, edit, and rejection event is logged in the immutable audit trail.
• Human oversight mandatory: Smart Notes is architecturally designed so that no draft can be saved to a patient record without a practitioner's explicit approval action. There is no bypass or automatic-save path.

8. Compliance Mapping

9. Incident Response SLA

All P1 and P2 incidents are personally escalated to our DPO and CEO. Practitioners affected by P1 incidents are notified within 24 hours of confirmed impact.

10. Sub-Processors

The following categories of sub-processors are authorised under our Terms of Service. All sub-processors are bound by data processing agreements requiring equivalent security standards and prohibiting them from using data for any purpose other than providing their specified service to us:

We will notify you of any changes to our sub-processor list at least 30 days in advance. To request the current sub-processor list, contact privacy@doctorsbench.care.