+966 56 533 0501 | info@datatime.com.sa
Procurement Requirements Checklist Request a quote
PsychFlow Mental Health Clinic & Counseling Management System
العربية Request a demo

Data privacy and permissions in the system

Explore authorization management, approvals, auditing, backup, and system operation options, and discuss your facility’s data protection requirements. Psychological services data is one of the most sensitive data, and the facility is responsible for it before its clients and regulatory authorities – so we wrote this page as verification questions to ask us and others, not as a list of slogans.

Discuss your project requirements Procurement Requirements Checklist
What you won’t find on this page
  • Slogans about “the highest safety standards” without detail.
  • Alleging liability that originally falls on your facility.
  • Absolute promises that are difficult to review in a contract.
  • General answers about data location and processing.

Who needs to see what?

The design principle is one: no one sees only what they need to do. Therefore, the data is separated into categories of different sensitivity, and each category has its own independent authority – administrative authority that does not open the door to professional content, and high administrative authority that does not mean absolute knowledge.

Data class Who usually looks at it? Officer
Administrative data

Communication, appointments, attendance, and order status — what’s needed to run the service day-to-day.

Reception is within range
Financial data

Invoices, packages, payments and dues without linking them to the content of the service provided.

Finance with independent authority
Professional data

Documentation of sessions, assessment results, and care plans — the most sensitive groups.

Assigned specialist and supervisor only
Bulk reports

Indicators with no metadata, with a minimum number before any detail is displayed.

Administration and contracting parties
View and modification record

Who opened what when, who modified and exported — a record that cannot be modified or deleted.

For the person authorized to audit
Test permissions by experiment, not by description. Request in the offer an account with receiving access, and then attempt to access session documentation or assessment results. The description in the booklet is easy, the actual prevention is what matters. He repeated the experiment with the account of a manager: his administrative capacity should not open him to professional content.

Participation, Consent and Representation

Every release of information from the system — to a guardian, referral, or contracting party — must be based on consent of known scope and date, and leave a trace. Consent is not a piece of paper that is signed once upon registration, but a living record that is reviewed and withdrawn.

Approvals with a specific scope

Every approval has its purpose, scope, effective date, and duration. There is no general, open-ended approval for everything.

Authorization and representation

Parent, legal representative or caregiver, with prescribed authority that changes with the relationship.

Sharing documents

What is shared is identified by name and its recipient, time and scope are recorded, no free transmission outside the system.

Withdrawal of consent

Withdrawal stops any new issue within its scope, and what was previously issued remains documented by its date and recipient.

What is shown to the client

Your facility determines what is displayed in Portal, professional content is blocked by default.

Share history

A complete series that can be reviewed whenever you have any questions: What is your partnership, with whom, with what permission, and who approved it.

Hosting, processing and transcription

These are your IT team’s questions, and their answers are written in the presentation, not verbally. We explain the operating options available and choose with you what suits your facility’s policy and regulatory requirements.

Data location Hosting options within the Kingdom for those whose policy requires this, and the location is specified in the contract.
Operation options Cloud operation managed by the provider, or an arrangement that suits your entity’s requirements.
Data separation Data for each facility is logically isolated, and is not mixed with others in any display or report.
Access management Accounts under each user’s name, no shared accounts, with immediate access and exit policies.
Backup Periodic copies with an announced schedule and a specific retention period written in the service agreement.
Restore A tested restore procedure with a target duration, not just untested copies.
Audit log Registration of access, modification and export, with review authority independent of operation authority.
Export your data Your right to extract your data into a usable format, under terms written in the contract.
Compliance Shared Commitment No Service Purchased. Your facility is the controller of its clients’ data and responsible for its policies, approvals, and retention periods, and we provide technical controls that enable you to apply and document them. Any provider who promises that purchasing their system will “keep you compliant” is selling you a reassurance they don’t have — review your requirements with your systems advisor and ask that they be translated into terms in the contract.

What documents do you require before contracting?

Request these documents from each provider you compare, not just us. Whoever presents it in writing is different from whoever answers it in a meeting, and the difference becomes apparent the day it needs to be invoked.

List of what you should receive in writing

Seven documents attached to the commercial offer or available upon request:

  • Description of the technical and organizational controls applicable to your data.
  • Determine processing responsibilities: what is the provider’s responsibility and what is your facility’s responsibility.
  • Supported operating, hosting and data location options.
  • Backup policy, retention times, and restore procedure.
  • Procedure for dealing with and reporting security incidents and its timing.
  • Conditions for exporting data upon termination of the contract, its format and duration.
  • Service Level Agreement: Coverage, response times and support channels.

Questions that quickly reveal the difference

Ask it in the technical meeting and see if the answer comes in detail or in general terms:

  • Which provider has access to my facility data, and under what procedure?
  • Does support access appear in the audit log I see?
  • When did you last try restoring from a backup?
  • What happens to my data after the contract ends, and within how many days will it be deleted?
  • Is my facility data used for any purpose outside of providing the service?

Discuss security requirements with the relevant team

Bring your technology and privacy officer — or your trusted advisor — to a session dedicated to this file alone. We demonstrate permissions, audit trail and approval management in action, answering your requirements one by one.

Technical session separate from the commercial presentation

Mixing a technical discussion with a commercial presentation harms both: the security detail gets lost between the explanation of the benefits, and the meeting drags on without result. We prefer an independent session attended by specialists from both parties, from which a record of what was agreed upon can be included in the offer.

Download the purchase requirements list

Submit your requirements before the session

Five elements that make a session productive:

  • Your approved privacy and data protection policy, if any.
  • Data location requirements if you have a specific policy.
  • Extend the data retention periods you are committed to.
  • Your job roles and the limits of knowledge of each of them.
  • Any requirement imposed on you by a licensing or contracting entity.
Discuss your project requirements Request a demo

Information technology and privacy questions

Three frequently asked questions in pre-accreditation technical review.

Does the reception review professional notes?
No. The receptionist sees what is necessary for his work: contact information, appointments, attendance status, and financial dues. Documenting sessions, evaluation results, and care plans is completely outside its scope, and is not a matter of preparation that can be bypassed, but rather a separation in the structure of permissions. The same applies to managerial roles: the manager status does not unlock professional content unless he is an authorized supervisor of those cases. Ask to test this with an actual account in the demo.
Where is the data processed?
This is specified in the offer and contract and not on a marketing page, as it depends on the operating option chosen by your facility. Hosting options are available within the Kingdom for those whose policy or regulatory body requires that data remain within it. The contract specifies the hosting party, the processing location, and who has operational access to it from us and under what procedure. If your facility has a specific requirement in this aspect, send it with the request for proposal so that the arrangement can be built on it from the beginning.
How is export and access determined upon termination of the contract?
There are clauses written in the contract before signing it, and this is the most important clause that is usually overlooked. The contract should specify: what format your data will be exported and what it includes, how long after notice of termination the export will take place, at what cost, when your users will stop accessing it, and when your data will be deleted from the provider’s systems and with what certainty. Your data is the property of your facility in any case, and the only acceptable role for the provider is to deliver it in a usable form and not keep it on pressure paper.

Test the controls before you sign

Do not rely on written description. Request accounts with different roles, try to bypass permissions yourself, and ask to see the audit log of your attempt. This half an hour saves you the need to review twenty pages of specifications.

  • A practical test of permissions with real accounts.
  • Controls and responsibilities documents are written with the offer.
  • Export and termination terms are clear before signing.
Discuss your project requirements Request a demo

Read on

Pages related to data protection.

Website Privacy Policy
Request a demo
Request a quote +966 56 533 0501