On this page
Healthcare software carries information that can be highly sensitive. Relify therefore applies security at multiple layers rather than relying on a single control. The controls described here are intended to reduce risk, preserve confidentiality and integrity, and support accountable access to the platform.
This page is a public overview, not an exhaustive technical specification or guarantee that a security incident can never occur. Security controls evolve as Relify, its infrastructure and applicable threats change.
Users are intended to receive only the permissions and branch scope necessary for their role.
Encryption, access control, application controls, infrastructure safeguards and monitoring work together.
Access, changes and important operational activity can be recorded to support review and investigation.
Security approach
Relify uses a defence-in-depth approach. Security is considered across the application, data, infrastructure, user-access and operational layers so that failure of one safeguard does not automatically remove every other protection.
Identity and access controls
Relify uses role-based permissions and scoped access so that staff can be limited to the modules and information appropriate to their responsibilities.
Data protection
Relify applies technical and organisational safeguards to protect Customer Data, including patient and clinical information. Existing production security materials specify TLS 1.2 or later for data in transit and AES-256 encryption at rest for protected storage.
- Access to sensitive information is intended to be limited to authorised users and services.
- Clinical files, invoices and operational records are protected using infrastructure and storage controls appropriate to their function.
- Data handling is designed around the requirements applicable to Relify under Malaysia's personal-data protection framework.
- Encryption is one safeguard among several and does not replace appropriate access controls, endpoint security or staff practices.
Application and infrastructure security
Relify separates application responsibilities across controlled services and infrastructure providers. Security work includes configuration management, access restrictions, dependency and platform maintenance, and isolation appropriate to the service being operated.
Controlled access paths
Server-side permission checks, authenticated requests and feature gates help prevent a user interface from becoming the only security boundary.
Managed environments
Hosting, storage and supporting services are operated through managed providers and are limited to the functions required to deliver Relify.
Because infrastructure and provider configurations change over time, current material providers are published separately on the Subprocessors page.
Auditability and monitoring
Relify is designed to maintain traceability for important platform activity. Current security materials describe auditability across access, edits, logins and clinical actions.
- Security and operational logs can support investigation of suspicious or unexpected activity.
- Important changes and user actions may be associated with the authenticated account that performed them.
- Audit information is itself sensitive and access to it should be restricted to appropriate administrators or authorised personnel.
AI security boundaries
Relify's general AI Assistant is designed to operate inside the user's authorised business and operational scope. It may answer status questions, analyse permitted clinic data, generate reports and, where enabled, perform operational actions requested by the user.
The Assistant does not receive permission merely because a user asks for something in natural language. Application permission checks, branch scope and action-specific controls remain part of the execution path. Sensitive or consequential actions may require additional confirmation.
Patient-specific Clinical AI is separate. Clinical AI is provided inside the EMR for authorised clinical workflows. It is not intended to turn the general business Assistant into an unrestricted clinical-data interface.
Resilience, backups and incident response
Relify maintains backup, recovery and incident-response procedures intended to reduce the impact of service interruption, data loss or suspected compromise. Existing platform materials describe daily backup processes together with recurring restore and recovery planning.
- Backups and recovery procedures are maintained as part of service continuity planning.
- Security events can be investigated using available logs, infrastructure information and account activity.
- Where a personal-data breach triggers legal notification duties, Relify follows the applicable contractual and legal process.
- Customers should promptly report suspected compromise involving their Relify accounts or users.
Detailed privacy and breach obligations are addressed in the PDPA Statement and Data Processing Addendum.
Service-provider security
Relify depends on infrastructure, communications, storage and other service providers. Vendors are intended to receive only the access or data necessary for the service they provide, subject to appropriate contractual and technical safeguards.
Material providers that process Customer Personal Data are identified on the Subprocessors page. Their own infrastructure and nested providers may change independently, so the published list should be reviewed alongside their current contractual documentation.
Shared responsibility
Security is shared between Relify and each clinic. Relify protects and operates the platform; clinics control their staff, devices, access choices and many day-to-day uses of the service.
Protect and operate the platform.
Maintain platform safeguards, permission mechanisms, infrastructure controls, logging, recovery processes and service-provider governance.
Use the platform securely.
Assign appropriate roles, protect credentials and devices, remove former staff access, use supported browsers and report suspected incidents promptly.
Assurance, certifications and responsible disclosure
Relify applies security practices aligned with commonly used security principles, but an implemented control does not by itself mean the company holds a particular certification. Relify does not claim ISO, HIPAA or another formal certification unless that certification is expressly and currently published by Casemix Solutions.
Technical and organisational safeguards reduce risk but cannot eliminate every possibility of misuse, software defect, provider outage, credential compromise or malicious attack. Security representations on this page should therefore be read as descriptions of controls, not absolute warranties.
If you believe you have identified a vulnerability, suspicious access or another security issue involving Relify, provide enough detail for the team to investigate while avoiding unnecessary access to patient or clinic data.
security@relify.com.my