Security & compliance

Hospital-grade by default

Clinical governance teams review OncoSync before it touches a patient record. We build for that review, not around it — here are the controls, the audit trail, and what we send you up front.

Request the security pack How access is scoped across centres
Security & compliance

Hospital-grade by default

Clinical governance teams review OncoSync before it touches a patient record. We build for that review, not around it.

AES-256 encryption
Two-factor authentication
Password rules at account creation
Role permissions
Immutable audit logs
Regional data residency
Controls in detail

The specifics your governance review will ask for

Each of these is a control we can evidence, not a posture we claim. If your review needs a mechanism we have not listed, ask — the answer is either a control or an honest no.

Data protection

Patient data is encrypted end to end and never leaves the boundary you approve.

AES-256 at rest, TLS 1.3 in transit
Per-tenant key separation, keys rotated on schedule
Encrypted backups with restore tested, not assumed
No patient identifiers in application logs or analytics
Production data never copied to test environments

Identity & access

Every account is created under enforced password rules and a second factor, and keeps only the access its role on the case requires.

Two-factor authentication on every account
Password rules enforced at account creation — length, complexity, reuse
Permissions scoped by specialty, site and individual case
Break-glass access requires a recorded justification
Idle sessions expire; device sessions revocable centrally

Auditability

Every read and every write is recorded in an append-only log the tenant can verify independently.

Append-only entries, hash-chained so gaps are detectable
Reads logged, not only edits — who opened what, when
Denied attempts recorded with the rule that blocked them
Exports require a stated reason, retained with the entry
Log stream deliverable to your own SIEM

Residency & retention

Your data stays in the region you choose, for exactly as long as your policy says.

Region pinned at tenant creation, no cross-region replication
Sub-processor register published and version-controlled
Retention periods configured per record class
Contractual deletion timelines, confirmed in writing
Full export in open formats on exit, at no charge
Immutable audit trail

Every read, every write, every refusal

This is the drawer a governance analyst opens on a case, filtered by section or by specialist. Entries are append-only: nothing is edited after the fact, so the value a decision replaced stays on the record next to the one that replaced it.

Mrs R. AdeyemiMRN 4419-084MP
WORKUP Collapse all
Patient Details
Clinical Workup · Full Assessment
STAGE 01
Salutation *Mrs
Patient Name *Rachel Adeyemi
Date of Birth04-11-1971
Age54yrs
GenderFemale
Blood GroupO+
ABHA ID12-3456-7890-1234
Aadhar IDEnter Aadhar ID
Medical Insurance IDEnter insurance ID
Insurance CompanyEnter insurance co
Emergency Contact NameT. Adeyemi
RelationshipSelect…
Phone Number+44 7700 900412Valid phone number
Address *14 Northfield Road, Birmingham B31
Save & Proceed
Patient History & Symptoms
Clinical Workup · Full Assessment

Audit Trail

46 events

R. Adeyemi · All clinical sections

All SectionsAll Specialists
Added Updated Removed
MONDAY, 27 JULY 2026· 5 entries
  1. MP
    Dr M. Patel
    MDT Decision· 02:16 pm
    ~1
    updatedRecommendation

    Intent: curative · Sequence: upfront surgery, then adjuvant chemotherapyIntent: curative · Sequence: neoadjuvant AC → paclitaxel + carboplatin, surgery on response

  2. AW
    Dr A. Whitlock
    Clinical Staging· 02:15 pm
    ~2
    updatedRadiological stage

    cT2 cN0 cM0 · Stage IIAcT2 cN1 cM0 · Stage IIB · axillary node biopsy positive

  3. RP
    Ridgeway Pathology
    Pathology Reports· 02:11 pm
    ~1
    addedReceptor status · CAP synoptic

    ER − · PR − · HER2 0 (IHC) · Ki-67 68% — triple-negative (TNBC), grade 3

  4. SI
    S. Iqbal
    MDT Attendees· 02:04 pm
    ~1
    removedPanel member

    Dr L. Fenn · Trials unit · withdrew before the voteSix attendees recorded, all present at sign-off

  5. PO
    Dr P. Oyelaran
    Radiation Oncology Planning· 01:58 pm
    ~3
    addedPrescription

    Adjuvant whole breast 40 Gy / 15 Fx + boost · heart mean 3.4 Gy within constraint

Before you commit

The review pack, sent before the first call

Governance teams should not have to take a sales call to see the documentation. Ask and it is sent — complete, current, and with the gaps named where they exist.

Request the security pack
What the pack contains
Most recent penetration test summary
DPIA pre-filled for the OncoSync deployment
Sub-processor register and data residency statement
Access control and audit log specification
Incident response and breach notification policy
Business continuity plan with restore test evidence
Request a demo

See it with one of your own cases

A 30-minute session with a clinical lead, walked through your own MDT workflow. No slides unless you want them.

No patient data required for the demo
Security pack sent ahead of the call