Encrypted in Transit
All data travels over HTTPS/TLS. Every connection between the app, staff devices, and our backend is encrypted. There is no unencrypted data path.
Data Minimisation
The platform is designed for operational dispatch rather than clinical records. Fields, retention, and prohibited data are agreed with each hospital before deployment.
Role-Based Access
Every account has an assigned role — Doctor, Interpreter, Porter, Nurse, or Admin. Access rules ensure each role can only read and write data within its own scope.
Regulatory Alignment
Designed to support hospital requirements
One Click Away is designed to support hospitals in meeting applicable ADHICS and UAE data-protection requirements. This is a design objective, not a claim of certification, approval, or independent compliance assessment.
- Minimal data collection — only fields operationally necessary are stored. No biometrics, no clinical notes, no payment data.
- Role-based access controls — admins have full visibility; staff see only what is relevant to their role.
- Request lifecycle records — implemented workflow stages are timestamped, with exports available where configured.
- Retention controls — retention and deletion periods are documented per deployment and contract.
- Contract documentation — a draft DPA and subprocessor schedule are available for client legal review.
Data residency: Hosting regions, cloud providers, and subprocessors are disclosed before contracting. Any UAE-residency commitment must be agreed in writing before deployment.
Assessment Boundary
No unsupported certification claims
Regulatory applicability, lawful basis, controller and processor roles, residency, retention, and breach notification duties depend on the hospital, deployment, and contract. These are reviewed with hospital legal and IT teams before go-live.
- No claim of ADHICS certification, government approval, or independent attestation
- Deployment-specific data inventory and flow review before production
- Contractual obligations recorded in the DPA and security schedule
- Residual risks and remediation items disclosed to the client
Access & Authentication
Who can log in and what can they see
Staff accounts
- Credential-based login managed by hospital admin
- No self-registration — all accounts created by admin
- Admin can deactivate any account instantly
- Each role sees only its own operational data
Admin accounts
- Separate protected admin portal
- Full read access to all requests, staff, and reports
- Account creation, deactivation, and role assignment
- Activity is logged for audit purposes
Transparency
What One Click Away does not do
- We do not sell or share hospital operational data with any third party
- We do not use hospital data to train AI models or for product analytics
- We do not store credit card or payment information — billing is by bank transfer or invoice
- We do not access patient medical records — we have no integration that pulls clinical data
- Analytics tracking is present on the marketing site only — never inside the operational apps
Incident Response
Security incident & breach notification
Suspected incidents are triaged, contained, documented, and escalated to affected hospital contacts. Notification timing, regulatory coordination, evidence preservation, and remediation reporting follow the applicable law and the signed client agreement.
Security concerns: Report suspected incidents immediately to support@1clickaway.xyz. Contracted clients receive a private incident-escalation route and response commitments.