Compliance & Security

Your patients' data is sacred.
We treat it that way.

MedOps is built to the highest data protection standards in Africa and globally — so you focus on patient care, not compliance paperwork.

Regulatory standards we meet

HIPAA

HIPAA

Health Insurance Portability and Accountability Act

MedOps implements all HIPAA Technical, Physical, and Administrative Safeguards. Business Associate Agreements (BAA) are available on Professional and Enterprise plans.

  • Patient data encrypted at rest and in transit
  • Role-based access with full audit trail
  • Automatic session timeout
  • BAA available on request
GDPR

GDPR

General Data Protection Regulation (EU) 2016/679

We follow GDPR principles of data minimisation, purpose limitation, and storage limitation. Patients retain full rights to access, correct, and delete their data.

  • Data processing agreements (DPA) available
  • Consent management built into intake flows
  • Right-to-erasure workflows
  • EU data residency option on Enterprise
NDPA

NDPA

Nigeria Data Protection Act 2023

MedOps is compliant with Nigeria's NDPA, administered by the NDPC — covering lawful basis requirements and data subject rights for Nigerian healthcare contexts.

  • NDPC-aligned privacy notices
  • Data breach notification within 72 hours
  • Data Protection Officer available
  • Local data processing documented
SOC

SOC 2 Type II

Service Organisation Control 2

Our infrastructure and processes are independently audited against the Trust Services Criteria for Security, Availability, and Confidentiality.

  • Annual third-party audit
  • Penetration testing every 6 months
  • Vulnerability disclosure programme
  • Report available under NDA for Enterprise

How we protect your data, technically

Encryption

AES-256 at rest via Supabase + Cloudflare R2. TLS 1.3 in transit on all endpoints.

Audit Logging

Every create, read, update, and delete on clinical data is logged with timestamp, user, IP, and action.

Infrastructure

Hosted on Supabase (Postgres with RLS) and Cloudflare R2. No data touches a third-party analytics pipeline.

Access Control

Granular RBAC: super_admin → host_admin → admin → staff → patient. No lateral privilege escalation.

Data Residency

Default: global CDN. Enterprise customers can pin data to Nigeria, EU, or US regions.

Vulnerability Mgmt

Dependencies scanned on every commit. Critical patches deployed within 24 hours. Responsible disclosure at security@medops.io.

Need a Business Associate Agreement?

HIPAA-covered entities on Professional and Enterprise plans can request a signed BAA. We respond within one business day.

Request a BAA

Compliance handled. Focus on your patients.

Every audit log, access control, and encryption key managed automatically.

Get started