Security and data ownership
Health data handled with care and accountability.
Moana is built for organisations that answer to patients, clinicians and regulators. Access is governed by role, sensitive actions require justification, every action is recorded against a named user, and the data belongs to the organisation that collects it.
Trust centre at a glance
Security by design
Protection is an architectural requirement, not a setting.
Security controlsAccess and consent
Clinical access is matched to clinical responsibility, and sharing follows the patient’s consent.
Access and consentAudit trail
Every view and every change is recorded by person, module and time.
The audit trailHosting and data sovereignty
The practice, hospital or government owns its data. Hosting is agreed with each client.
Data ownershipCompliance and registrations
Registered with the institutions that fund health systems.
RegistrationsPolicies and contact
Our five policies, and who to contact about security or privacy.
Policies
Governance
Security and privacy by design.
How Moana protects patients, clinicians and the organisations that run it.
Health information is among the most sensitive data any organisation holds. Moana treats its protection as an architectural requirement rather than a setting. Permissions are enforced on the server for every action, each facility’s data is separated even when several facilities share one platform, and records move between facilities only with the patient’s consent.
Access by role, down to each action
Permissions are enforced on the server for every action, not only hidden in the screen.
Each facility’s data kept apart
Strict separation of each facility’s data, even when several facilities share one platform.
Two factor authentication
A second factor at sign in for ministry users and any staff account the organisation chooses.
Encrypted local storage
Data held on desktop devices for offline work is encrypted on the device.
Safe sync
Work saved during an outage syncs in order. Deleted records cannot return, and conflicting edits are held for review.
How offline working works
Access and consent
Clinical access matched to clinical responsibility.
A clinician sees the patients in their care, and access to any other record requires a recorded reason through audited emergency access.
Patient consent for sharing
Records are shared between facilities only with the patient’s consent, and patients can revoke it.
Audited emergency access
Break glass access to a record outside a clinician’s own list is possible in an emergency, and is logged with a reason.
Every action against a named user
Sensitive actions require justification, and every action is recorded against a named user.
Shown, not described
Every action, on the record.
The audit log records who did what, where and when. Possible duplicate patient records are held for review before they reach national figures.
A complete audit trail
Every view and every change is recorded by person, module and time, so organisations can answer who saw what, and why, at any point.
Hosting and data sovereignty
Your data stays yours.
Ownership is unambiguous: the practice, hospital or government that collects the data owns it, and hosting is agreed with each client.
The organisation owns its data
The practice, hospital or government owns its data.
Hosting agreed with each client
Where the data is hosted is agreed with each client.
Set out in the agreements
Read how client data is processed, and the terms of each engagement.
Data processing agreement
Compliance and registrations
Registered with the institutions that fund health systems.
- UNGMUnited Nations Global MarketplaceRegistered supplier, ID 1210269
- ADBAsian Development BankConsultant register, CMS ID 049609
- WHOWHO Digital Health AtlasRegistered system
- SCTSNOMED CTAffiliate licence, Australian Digital Health Agency
- ACNMoana Digital Health Pty LtdACN 694 101 052 · ABN 41 694 101 052
- ™MOANA DIGITAL HEALTHTrademarked
Questions from your security or privacy team?
We are happy to walk them through access control, audit and hosting in detail.
Report a security concern: contact@moanadigitalhealth.com