Each clinic walled off in the database, each person seeing only what their job needs, and every action kept with who and when.
What each guard means, in plain words.
No other clinic can ever see your patients; the database itself keeps them apart.
Each person sees only what their job needs; access reviews flag the rest.
A code from an authenticator app at every sign-in, and breached passwords refused.
Only the clinician who marked it reads it; anyone else needs emergency access, which is reviewed.
A person presses send; every NPHIES message is kept as sent and received.
Every page our support team reads appears in your access report.
31 roles, from the front desk to the pharmacist. Access reviews flag anyone who has more than their job needs.
Records marked sensitive need a reason and a password to open in an emergency. Access lasts an hour, and the clinic manager reviews it.
When an insurer or an auditor asks, the answer is on file: every change with its old and new values, who made it and when.
Send them to security@nabdah.ai. We reply in Arabic or English within two working days.
We are the custodians of your records. You remain their owner.
Keeps your clinic apart from every other, logs every change, and asks before anyone from our team looks.
Two-step sign-in for everyone, one role per person, leavers removed the same day, and a weekly look at the access report.
| Requirement | What it covers | Status |
|---|---|---|
| Personal Data Protection Law (PDPL) | How patients’ personal data is collected, used and kept | [In progress: privacy programme and counsel-reviewed notice] |
| NPHIES | How claims and cover checks reach insurers | [Certified: issuer, date, reference] |
| ZATCA Phase 2 | How invoices are issued and kept | [Production onboarding: date] |
| Hosting | Where your records are stored and processed | Saudi Arabia |
| Backups | Continuous and encrypted, kept in the Kingdom, restorable to any minute | [In progress: continuous backup to a bucket in the Kingdom, restore tested, retention period] |
| NCA controls | The National Cybersecurity Authority’s essential controls | [Status] |
Ask us anything about security, in Arabic or English. A person from our team answers on WhatsApp, within 15 minutes in clinic hours.
Chat on WhatsAppIn Saudi Arabia: your records are stored and processed in a data centre inside the Kingdom. Every change is backed up within minutes, encrypted and kept in the Kingdom, so we can restore your clinic to any minute in the last [30] days.
Only with your permission. Every page our support team reads appears in your access report.
Remove them from your team and their access ends at once. Their past actions stay on the record.
No. A signed note is locked. A correction is added as an amendment, and the original stays.
Yes. Everything between your screen and Nabdah is encrypted, and two-step sign-in stops a stolen password on its own.
You are the controller of your patients’ data; Nabdah processes it for you, under a written agreement.
Yes. If you leave, we export your clinic’s records and hand them to you.
A 30-minute demo of your own day, from the booking to the bank. Bring a month of rejections, and we’ll show you which ones Nabdah would have stopped.
We’ll message you on WhatsApp within one working day to pick a time.
Certified on NPHIES