Security

Our approach

Security is designed into the platform across every layer: experience, intelligence, healthcare systems, commerce, financial, insurance and integration. We apply defence-in-depth rather than relying on any single control.

Access control

Role-based and permission-based access control governs who can see and do what — including AI-assisted access through Haya, which operates strictly within the requesting user’s permissions.

Encryption

We encrypt data in transit (HTTPS/TLS) and apply encryption and protection controls to stored data, with heightened safeguards for health information.

Authentication

Secure authentication for platform accounts, with session and token management and protection against credential abuse.

Auditability

Access and actions on sensitive information are audit-trailed so that healthcare data handling can be reviewed and accountability maintained.

Data minimization

We collect and retain only what is necessary for the service, and de-identify or remove data when no longer needed.

API security

APIs are authenticated, validated and rate-limited; secrets are managed server-side and never exposed in frontend code.

Transaction monitoring

Commerce, payment and claims flows are monitored for anomalies and misuse.

Certifications

We do not publish compliance or certification claims that have not been independently verified and approved by the company. Where certifications are achieved, they will be listed here with evidence.

Report a vulnerability

Please report security vulnerabilities responsibly to info@medical-street.com. Do not access other users’ data while testing, and give us a reasonable opportunity to remediate before disclosure.

Updates

This document is maintained by Medical Street International Co. Ltd (Uganda) and is updated as our services evolve. The current version is always the one published on this page.

Questions about this policy? Contact info@medical-street.com or use the contact center.