Security & privacy
Health data deserves boring, careful engineering.
Patients trust hospitals with information about their bodies. Hospitals trust us to hold it. These are the controls that make that trust reasonable.
01
Least-privilege access
Every user has a role, every role has explicit permissions, and permissions can be narrowed to a branch, department or assigned patients. Nothing is visible by default.
02
Organisation isolation
Each customer organisation's data is logically separated from every other. Branch boundaries are enforced on the server, not just hidden in the interface.
03
Audit trail
Record views, edits, inventory movements, approvals and result releases are logged with the user and time. Logs can't be edited by customers or staff.
04
Encryption
Data is encrypted in transit with TLS 1.2+ and at rest with AES-256. Attached files are stored encrypted and served through short-lived, signed links.
05
Account protection
Two-factor authentication, session timeouts on shared workstations, and single sign-on on Enterprise plans.
06
Backups & recovery
Automated, encrypted backups with point-in-time recovery, tested on a regular schedule.
Data protection
You control the data. We process it on your behalf.
Your organisation is the data controller for the patient and staff information it records in Biomatrix. We act as a data processor, handling that information only to provide the service and only on your documented instructions.
We design our processes around the Nigeria Data Protection Act 2023 and the GAID 2025, and support customers in meeting their obligations, including responding to patient access and correction requests.
Read the data processing agreement and privacy policy for the full terms.
Disclosure
Found something? Tell us.
If you believe you've found a security vulnerability in Biomatrix, email security@biomatrix.ng with the details. We acknowledge reports within two business days and keep you updated until it's resolved.
Please don't access patient data, disrupt service, or test against customer accounts you don't own.
See your own hospital in it.
Bring your branch list, your departments and a typical day. We'll set up a working walkthrough around how you actually operate.