Patient data protection
Purpose limitation, data minimisation and support for access, correction and erasure requests.
Compliance & Security
Trust, designed into every workflow.
Relify is built for healthcare, where privacy, traceability and availability matter every day. Data protection, access control, encryption, audit trails and resilience work together as one security posture.
Hosted in Malaysia
AES-256 at rest
PDPA 2010 aligned
AWS · Malaysia
TLS 1.2+ · AES-256
Role + branch access
Audit trail
Patient record
MRN 10482
Dr Lim · Doctor
Unknown session
Access denied
Data protectionPDPA 2010 aligned
Primary regionMalaysia on AWS
EncryptionTLS 1.2+ · AES-256
RecoveryRTO 4h · RPO 15m
e-InvoiceLHDN production ready
A clear security posture, not a wall of badges.
Our compliance approach is organised around four practical outcomes: protect patient information, make access traceable, keep services resilient and be clear about how data is handled.
Security by design
Role-based access, least privilege, encryption, audit logging and isolated environments.
Reliability & continuity
Redundant infrastructure, layered backups and recovery procedures that limit downtime and data loss.
Transparency
Documented data flows, clear subprocessors and proactive communication about security incidents.
Designed for the Malaysian healthcare context.
Controls and workflows are designed around Malaysian data protection expectations, clinical traceability and production e-Invoice operations.
PDPA 2010 (Malaysia)Data protection and individual rights
- Lawful basis: Contract performance and legitimate interest for healthcare operations.
- Individual rights: Access, correction and withdrawal of consent through legal@relify.com.my.
- Retention: Clinical information retained according to applicable legal and clinical requirements.
- Data export: Machine-readable formats available on verified request.
Ministry of Health contextAccess controls, traceability and auditability
Relify is designed for clinical environments that need controlled access to medical records and traceable activity across EMR, pharmacy, laboratory and billing workflows.
LHDN e-InvoiceProduction-ready billing integration
- Environment: Production ready.
- Capabilities: TIN validation helper, SST fields, invoice QR, fallback and reconciliation queues.
- Evidence: Request and response logs retained for seven years.
Controls across identity, application and infrastructure.
Security is applied in layers, so access, code, environments, data and day-to-day activity each have their own protections.
Encryption
- In transit: TLS 1.2 or higher.
- At rest: AES-256 for databases, object storage and backups.
- Key management: Restricted key access through AWS KMS.
Access control
- RBAC: Roles for administrators, doctors, nurses, pharmacy and finance teams.
- MFA: Available for privileged roles.
- Sessions: Short-lived tokens and secure cookies.
- IP controls: Allowlisting available on request.
Application security
- Secure SDLC: Code reviews and dependency scanning.
- Vulnerability management: CVE triage within seven days.
- Penetration testing: Annual summary available under NDA.
- Secrets: Managed storage with rotation.
Audit & logging
- Audit trails: PHI access, edits, logins, prescribing and dispensing.
- Tamper evidence: Critical logs retained for seven years.
- Monitoring: Real-time security event alerts.
Data isolation
- Tenant isolation: Logical separation by branch and authorised group scope.
- Environment separation: Development, staging and production use distinct credentials.
Reliability & recovery
- Backups: Daily snapshots and point-in-time recovery.
- Restore testing: Monthly.
- Objectives: RTO four hours and RPO fifteen minutes.
- Monitoring: Health checks, metrics, alerting and synthetic probes.
Know where data lives and how long it stays.
The data lifecycle is documented from collection to secure deletion, with hosting in Malaysia and defined retention periods.
Primary hosting in Malaysia, with controlled cross-border processing.
Malaysia · AWSOnly the information clinical and operational workflows need.
Role and branch permissions decide who can open each workflow.
Clinical, tax, audit and backup records follow separate schedules.
Secure deletion after a verified request and the applicable retention period.
Clinical recordsPer applicable legal and clinical requirements
7+ yearsAccess logsCritical access and security evidence
7 yearsAccount informationWhile active, then the tax-compliance period
Active + 7 yearsBackups30 days online, 12 months archived
30 days + archiveA transparent view of service providers.
Vendors are limited to what's needed to run Relify. Data processing agreements and appropriate safeguards cover any cross-border processing.
VendorPurposeData typesLocationControls
AWS S3File and object storageClinical documents and invoicesMalaysiaAES-256 at rest
AWS RDSPrimary databaseEMR metadata and billing informationMalaysiaDaily backups
AWS EC2Application runtimeRuntime processingMalaysiaIsolated environments
SendGridTransactional emailNames, email addresses and receiptsSingaporeSPF, DKIM and DMARC
WhatsApp Cloud APIOpt-in patient notificationsPhone numbers and template contentSingaporeOpt-in and approved templates
Prepared for interruption, designed for recovery.
Continuity combines monitoring, automated backups, defined recovery objectives and regular restore testing.
Reported availability · last 90 days99.9%
Operational90 days agoToday
Monitoring includes service health checks, operational metrics, alerts and synthetic probes.
Automated snapshots with point-in-time recovery.
Recovery procedures are tested on a recurring schedule.
Target recovery time objective for supported incidents.
Target recovery point objective for protected data.
Security works best when responsibilities are clear.
Relify protects the platform and gives you configurable controls. Clinics stay responsible for how staff use the service and how patient communications are managed.
Protect and operate the platform.
- Maintain encryption, infrastructure controls and secure environments.
- Provide role-based permissions, audit trails and monitoring.
- Maintain backup, recovery and incident-response procedures.
- Manage service providers and document relevant data flows.
Configure and use the platform securely.
- Configure RBAC and MFA appropriately for staff.
- Keep clinic identity, TIN, address and SST information accurate.
- Get patient consent for WhatsApp notifications where required.
- Keep devices and browsers updated.
- Report suspected incidents promptly to security@relify.com.my.
Clear about what's implemented and what's certified.
Relify applies enterprise-grade controls and follows practices aligned with widely used security standards. Formal certifications are only claimed when expressly stated.
Security controls don't automatically equal certification.
Relify does not claim HIPAA or ISO certification unless a current certification is expressly published. The platform applies many equivalent security practices and is working towards formal certifications.