Security & Compliance
Patient identity never leaves the country — by design, not by policy.
Confer separates who the patient is from what the case is about at the data-model level, encrypts sensitive data at rest, de-identifies imaging before it can be shared, and records every access. Below is exactly how — with real before/after examples — and the regulatory frameworks each control maps to.
01 · The identity firewall
A consulting surgeon's view has no code path to the patient's identity — the wall is enforced in the architecture, not just hidden in the interface. Only the right column ever crosses a border.
- Patient name
- Emirates ID
- Date of birth
- Contact details
- Original imaging
- Case reference (CNF-····-····)
- Age · sex · laterality
- Clinical summary & question
- De-identified imaging
02 · Encryption at rest
Identifying fields are never stored in plain text. Each value is encrypted with AES-256-GCM (authenticated encryption) under a master key held outside the database. Lookups use a keyed one-way blind index, so we can find a record without ever storing the searchable value in the clear.
03 · Imaging de-identification
DICOM files carry identity in their metadata tags; ordinary photos carry it in EXIF. Both are removed before the scrubbed copy is generated. Files that can't be safely auto-cleaned (burned-in annotations, PDFs) are held for manual review rather than shared.
(0010,0020) PatientID = 784-1985-1234567
(0010,0030) BirthDate = 19850312
(0008,0090) RefPhysician = Dr S. Khan
(0008,0080) Institution = Al Noor Hospital
(0010,0020) PatientID = (removed)
(0010,0030) BirthDate = (removed)
(0008,0090) RefPhysician = (removed)
Pixel data = preserved
04 · Access control & auditability
Role & per-case access
A surgeon sees a case only if they own it or were assigned it. The consultant view can never return identity fields.
WhatsApp OTP sign-in
No shared passwords. Access is tied to a verified phone; surgeons are onboarded and approved by an admin.
Immutable audit log
Every sign-in, view, send, upload, download, and opinion is timestamped with actor and object — encrypted at rest.
Session & request hardening
HTTPS-only, HSTS, strict Content-Security-Policy, CSRF tokens on every state change, secure same-site cookies.
05 · Data residency & cross-border transfer
All data is stored on UAE-based servers. Routing a case to a surgeon outside the UAE is blocked until cross-border transfer consent is recorded — and even then, only the de-identified, pseudonymous record is sent, never patient identity.
In-country storage
Databases and encrypted files reside on UAE infrastructure.
Consent-gated routing
Cross-border send is refused server-side without a recorded consent for the destination country.
06 · Regulatory alignment
Confer is engineered to align with the requirements below. This describes implemented technical controls — it is not a certification.
| Framework | Core requirement | How Confer addresses it |
|---|---|---|
| UAE Federal Law No. 2 of 2019ICT in Health Fields | Health data stored & processed inside the UAE; transfer abroad restricted. | UAE-hosted storage; identity never transmitted; cross-border routing sends only de-identified data and is consent-gated. |
| UAE PDPLFederal Decree-Law No. 45 of 2021 | Lawful basis, data minimisation, security, and subject rights over personal data. | Encryption at rest, least-privilege access, minimisation (pseudonymous sharing), full audit trail, consent capture. |
| Abu Dhabi DOHHealth Information & Data Standards | Protection, classification and traceability of health information. | Identity/clinical separation, encrypted PHI, immutable access log for traceability. |
| HIPAA (US)Applies to a US recipient, not the UAE platform directly | Safeguards for protected health information; de-identification standard. | A US consulting surgeon receives a de-identified, pseudonymous case — reducing PHI exposure at the boundary. |