Security and compliance
What an IT department or a data protection officer should know before entrusting its tumor boards to OncoRoom: who has access, what is traced, whose data it is.
Glass objects generated for illustration, reconstructed interface fragments, synthetic data.
The legal framework
Algerian law on the protection of personal data, and what the application does so that your institution complies with it.
Law no. 18-07 of 10 June 2018
Ask your questions in the demo request- Who has access
The professionals your institution authorises, role by role and tumor board by tumor board. Two-factor authentication is mandatory for everyone.
- What is traced
Sign-ins, views, changes, exports and role changes, in a log that cannot be rewritten.
- Whose data it is
Your institution’s. No other sees it, and a complete export is handed over at the end of the contract.
- What Unimed sees
Nothing without your agreement: support access is approved by your administrator, time-limited and traced.
Access
Who sees what, and which actions ask for the password again.
Two-factor authentication for everyone
Password and one-time code, for every user. Backup codes cover a lost phone.
The password asked again
To sign a report, export data or the audit log, or change a user’s roles.
Roles per tumor board
A member of the senology tumor board does not see the cases of the thoracic oncology tumor board. A referring physician only reads the signed reports shared with them.
An administrator who does not sit on a board
They manage accounts and tumor boards with no access to cases, as long as they hold no role on a tumor board.
Limited sessions
Signed out after 30 minutes of inactivity and after 12 hours at most, two durations your institution sets. After five failed sign-ins, the account locks for a while.
Supervised emergency access
One hour, with a written reason, recorded in the log; the tumor board’s coordinator is notified.
| Action | Coordinator | Board member | Presenting physician | Secretariat | Referring physician | Auditor | Administrator |
|---|---|---|---|---|---|---|---|
| Create a case | Yes | Yes | Yes | Yes | No | No | No |
| View the tumor board’s cases | Yes | Yes | Their own | Yes | No | No | No |
| Validate a case, add it to the agenda | Yes | No | No | No | No | No | No |
| Run the meeting, validate the decision | Yes | No | No | No | No | No | No |
| Sign the report | Yes | No | No | No | No | No | No |
| Read the report | Yes | Yes | Their own | Yes | Shared | No | No |
| View the indicators | Their boards | No | No | No | No | Yes | Yes |
| View and export the audit log | No | No | No | No | No | Yes | Yes |
| Set up a tumor board and its members | Their own | No | No | No | No | No | Yes |
| Create a tumor board, manage users | No | No | No | No | No | No | Yes |
Traceability
What is recorded, and who can read it.
Views and changes
The log records views of cases, reports and documents, every change, every sign-in, every export and every role change.
A log that cannot be rewritten
An entry can be neither modified nor deleted, and the log’s integrity is checked every night.
Readable by your institution
The administrator and the auditor filter the log, written in plain language (“Case viewed”, “Roles changed”), and export it as CSV after entering their password again.
In the name of the reader
Every document preview carries the name of the person viewing it as a watermark.
No medical data in emails
Neither in emails nor in notifications: “A tumor board report is available”, and a link.
Your data
It remains your institution’s.
A space of your own
No other institution sees your patients, your cases or your reports.
Exports at your initiative
Case lists and indicators as CSV, reports as PDF.
Returned at the end of the contract
A complete, encrypted export of your data and documents is handed over to you.
Signed, frozen reports
A correction creates a new version; the old one stays available.
The identity hidden on the wall
In the meeting, the coordinator can show only the patient’s initials and year of birth.
The Unimed team
It runs the platform without reading your cases.
No permanent access
The Unimed team has no permanent access to an institution’s data.
Support access you approve
Requested by an engineer with a reason, approved by your administrator, four hours at most, read-only by default.
Visible and traced
During the support session a banner warns your users; every action appears in your audit log.
Go-live
Nothing to install.
In the browser
On a hospital workstation, a laptop or a tablet, with no software to install.
An administrator on your side
They invite users, create tumor boards and assign roles.
A guide for each role
The application’s help centre guides the presenting physician, the coordinator and the secretariat, the tumor board members, the administrator and the referring physician.
Questions from IT
Not without your agreement. Support access is requested by an engineer, approved by your administrator and time-limited; a banner shows it, and every action appears in your log.
No. Each institution has its own space: its patients, cases and reports never leave it.
A neutral sentence and a link: “A tumor board report is available. Sign in to read it.” No medical data.
During the contract, lists and indicators export as CSV and reports as PDF. At the end of the contract, a complete, encrypted export is handed over to you.
No. OncoRoom runs in the browser, on the hospital’s workstations.
- On synthetic data We present a complete tumor board, from preparation to the signed report, in a demonstration institution.
- Your security questions Access, log, export: we go through them with your IT team during the demonstration.
- No patient data This form only asks for professional contact details.
Request a demo
Your IT department or your data protection officer can write their questions in the message: we answer them point by point before any commitment.