Security & data protection
Health data deserves plain answers. This page lists the controls that are in place today, the ones that are not, and how to report a problem. It changes when the platform does.
In place today
Every organisation is a separate tenant. Requests are scoped to the signed-in user’s organisation in the application, and an automated check runs on every code change to catch queries that could cross a tenant boundary.
The clinical database, caches and patient-file storage (including imaging studies) are encrypted at rest with AWS-managed keys. File storage is versioned, so an overwritten file can be recovered.
Browsers reach H-Link only over HTTPS, with TLS 1.2 as the minimum. Plain-HTTP requests are redirected to HTTPS, and every facility hostname is covered by our certificate.
Traffic passes through AWS WAF with managed rule sets for common web attacks, known-bad inputs and SQL injection, plus per-address rate limiting.
Staff are given roles, and each role sees only the workspaces and actions its job requires. Access tokens expire after 30 minutes and passwords are stored only as salted bcrypt hashes.
Any user can turn on two-factor sign-in with an authenticator app, with one-time backup codes for a lost device.
The database has automated backups with point-in-time recovery and is protected against accidental deletion. It is not reachable from the public internet.
Clinical records can be exported in standard FHIR R4 format through the bulk-data interface, and several modules offer their own CSV exports.
Not yet in place
A security page that lists only strengths is a sales page. These are the gaps a careful buyer should know about.
Data protection
The Data Protection Act, 2012 (Act 843) governs patient data about people in Ghana regardless of where a platform stores it. Your facility is the data controller; H-Link is your processor and acts on your instructions.
Patient data is hosted in the United States. Onboarding includes the Act 843 work that follows from that: registration with the Data Protection Commission, the notices you give patients, and the agreement between your facility and H-Link.
The services we use to deliver the platform are listed, with what each one receives, on the privacy page.
Responsible disclosure
Email info@h-link.solutions with “Security report” in the subject, the steps to reproduce, and what you believe the impact is. We will acknowledge your report and keep you updated until it is resolved.
Please do not access, change or delete other people’s data, run denial-of-service tests, or publish details before we have fixed the issue. Our security.txt has the same contact in machine-readable form.
In Amazon Web Services, in the United States (us-east-1, Northern Virginia). Some features — AI assistance, email and SMS — send data to the service providers listed on our privacy page.
Yes, for the AI features a facility uses. Patient-data AI runs on HMIE, our own medical models on GPU servers we control at a provider named in our sub-processor list, and a guard in the software refuses to send it to cloud AI companies. Two things that can carry clinical text do go further: questions typed into the knowledge assistant go to Google to find matching sources, and the dictation preview uses your browser’s own speech service (Google in Chrome, Microsoft in Edge).
Your facility is the data controller for its patients’ records; H-Link processes them on your behalf. During onboarding we help you with your obligations under the Data Protection Act, 2012 (Act 843), including registration with the Data Protection Commission.
Yes. Clinical records export in FHIR R4, the international standard for health data exchange, so they can be loaded into another system.
Yes. Email info@h-link.solutions and we will answer your questionnaire and walk your IT team through the architecture.
We will complete your security questionnaire and walk your team through how H-Link is built and run.