Security and User Permissions
Patient data is sensitive data under PDPA and most leaks come from inside: shared passwords, ex-employees who can still log in, or everyone seeing everything. APSX defines permissions by role and enforces two-factor login on key accounts.
- Each person sees only what their job needs
- A leaked password is useless without the authenticator code
- Trace who opened which record and when
- Revoke a departing employee's access instantly
What Security and User Permissions does
Two-factor login
Google Authenticator and SMS OTP.
Role-based permissions
Owner, manager, doctor, nurse, pharmacist, finance, down to menu and report level.
Login time control
Allow login only during set hours or working days.
Patient Data Privacy (doctor only)
Only doctors see medical notes; staff see service data (add-on).
Audit log
Every access, edit and print with user and timestamp.
Simple Control
The owner manages permissions, settings and users from one account.
How it works
- 1
Create standard roles and assign menus
- 2
Add users by branch and role; enable 2FA for owners and managers
- 3
Set allowed login hours for front-desk staff
- 4
Review the audit log regularly and close accounts on departure
Frequently asked questions
How are users counted?
Package N+ 15 users/branch, B+ 20 users/branch, PRO+ more. Everyone should have their own account so the audit log is meaningful.
Where is data stored and backed up?
On backed-up cloud infrastructure. Development follows ISO/IEC 29110 and ISO 10781 guidelines.
How far does it cover PDPA?
The system provides permission, consent and audit tools. The clinic still needs its own policies and processes under the law.