Security & trust
Patient data, treated like patient data.
A practice management system holds some of the most sensitive information there is. This page describes, in plain language, how Meta-Health is built to protect it — no marketing gloss, no claimed badges.
Data protection & POPIA
- Designed for POPIA-era practice Meta-Health is built for South African healthcare under the Protection of Personal Information Act: personal information is collected for the purpose of care and billing, and used for that purpose.
- Records are scoped, not pooled Clinical and billing records belong to the facility that treats the patient. The platform is designed so one organisation cannot see another's data, and within a group, records stay with their facility.
- Encryption in transit All traffic between browsers, the mobile app and the platform is encrypted with TLS. Files and documents are stored in secured cloud storage.
Access control
- Role-based, per module, per facility Every staff member holds a membership at a facility with a role, and permissions are granted module by module. The front desk sees the diary and the queue; clinical notes stay with clinicians; accounts stays with accounts.
- Tenant isolation by design Data access is scoped to the requesting user's organisation and facility, built into the platform's data layer rather than left to convention.
- Patients control their own account Patients hold their own login for bookings and their portal; access to dependants and family members is an explicit, auditable link — never assumed.
Authentication
- Modern password hashing Passwords are hashed with Argon2, a modern memory-hard algorithm designed to resist offline cracking. Plaintext passwords are never stored.
- Short-lived sessions Sign-ins issue short-lived access tokens that renew through a separate refresh flow, limiting the value of any intercepted token.
Application security
- Input validation at the door API input is validated against typed schemas before it touches a record, so malformed requests are turned away at the boundary.
- Errors that don't leak Failures return structured, minimal error responses. Internal details stay in the platform's own logs, not in what a browser sees.
- Disciplined engineering A strictly typed codebase, automated tests, linting and type checks in continuous integration, and reviewed changes — the unglamorous work that security actually rests on.
Operations
- Audit and activity logging Changes to records are attributable to the signed-in user who made them, and platform errors are captured centrally for investigation.
- Cloud infrastructure The platform runs on containerised infrastructure in Microsoft Azure, with environments for development, testing and production kept separate.
- Questions welcome Running a security review or a POPIA assessment for your practice? Talk to us — we'd rather answer the detailed questions than dodge them.
Put the hard questions to us.
Bring your practice manager, your IT partner and your POPIA officer to the demo. We'll show our answers in the product.