Security Policy
Last updated: 24 October 2026
Policy owner: Dr. Henna Safiyah Malik. Contact: hennamaikuk@gmail.com.
Scope and responsibility
This policy sets the security requirements for DrOnline, an adult-only service for people aged 18 and over. The platform operator is responsible for protecting its systems. The appointed clinic remains responsible for clinical decisions and its clinical records. Clinic discussions are ongoing; no clinic agreement has been finalised. Pharmacy and laboratory arrangements will be agreed through the selected clinic.
Hosting and permitted use
Patient data is hosted using Firebase in Doha, Qatar, as confirmed by the platform operator. Staff must not move patient records to personal storage or unapproved services. Any proposed change to hosting or data recipients requires a privacy and security review before implementation. Optional external processing, where offered, must be separately disclosed and consented to; it must not be inferred from the hosting location.
Access to patient information
Access to clinical information is limited to treating doctors and authorised administration staff with a work-related need. Administrators must use only the information necessary for their assigned duties; administrative access does not authorise clinical decisions. Patients may access their own information. Pharmacy and laboratory services must receive only the information needed for the agreed service through the clinic; delivery staff must not receive the clinical record.
Staff accounts and devices
Every staff member must use an individual account. Shared passwords and accounts are prohibited. Privileged and clinical accounts must use multi-factor authentication. Access must be approved before use, reviewed at least quarterly, and removed promptly when duties change or employment ends. Devices must be updated, access-protected and locked when unattended. Suspected compromised accounts must be reported immediately.
System protection and confidentiality
The technical administrator must maintain encryption in transit and at rest, enforce access permissions at the data layer, and keep credentials outside client code and public repositories. Security updates must be prioritised according to risk. Changes affecting patient data require review and testing before release. Staff must complete confidentiality training before access is granted and at least annually thereafter. Production patient data must not be copied into development or demonstrations.
Audit records and monitoring
The technical administrator must maintain restricted audit records of staff access, permission changes, exports, deletions and security events. Logs must identify the actor, time and action without unnecessarily copying health information. Suspicious access must be investigated promptly. The privacy contact must review security findings and corrective actions with the technical administrator.
Backups and recovery
Backups must be encrypted, restricted to authorised personnel and subject to the same Qatar hosting requirement as primary records. The technical administrator must document backup frequency and recovery arrangements, test restoration at least quarterly and record the results. Recovery must preserve deletion decisions and legal holds, so deleted information is not returned to ordinary use after restoration.
Consent and patient rights
The consultation includes a privacy consent checkbox for processing medical information by licensed healthcare providers for medical care. Staff must respect the purpose of that consent. Access, correction, withdrawal and deletion requests are handled by Dr. Henna Safiyah Malik and coordinated with the treating clinic where necessary. Withdrawal does not automatically erase records that must lawfully be retained.
Retention and disposal
Clinical questionnaires, clinical messages, relevant photographs and test results must be retained for at least five years from the last clinical interaction or clinical entry, whichever is later. Longer applicable requirements and complaint, investigation or litigation holds take precedence. Expired records must be reviewed and securely deleted or irreversibly anonymised when no further lawful retention is needed. Optional non-clinical images follow their separately disclosed schedule.
Review and accountability
Dr. Henna Safiyah Malik owns this policy. The technical administrator and clinic medical director must maintain evidence that the required controls operate in practice, record any gaps and corrective actions, and review this policy annually and after significant incidents or service changes. This policy states required standards; its publication is not a certification that every control has been independently audited.