Compliance and data residency
Written for information governance committees. It states where patient data is stored, every party that touches it, how the audit trail relates to Pakistani evidence law, and what remains unresolved.
Where data is stored
The practical default where in-country hosting is not available. Singapore has a mature data protection regime, no political sensitivity for a Pakistani institution, and latency that does not affect a form-based clinical workflow.
Typically 90 to 140ms from Pakistan. Acceptable for this workload.
Available regions
Who touches the data
Every party with access, which is what a data processing agreement schedule has to enumerate in any case. Two of these are United States based regardless of the database region, so any deployment other than fully self-hosted involves some cross-border transfer. We would rather say that here than have it found later.
Database and authentication
Application hosting and edge network
AI features. Receives clinical text only when an AI feature is invoked.
Email delivery of patient links
The audit trail and Pakistani evidence law
Electronic records are admissible in Pakistan under the Electronic Transactions Ordinance 2002 and the Qanun-e-Shahadat Order 1984, subject to the court being satisfied as to integrity and authenticity. The audit trail is built to meet that test: entries are append-only and enforced at the database level, so no surgeon, no member of staff and nobody at SynaptoNex can edit or delete one. Every entry carries the identity and the role of whoever performed the action. An entry made in error is voided with a written reason, and both the original and the correction remain visible.
Whether a record is admitted in any particular proceeding is a matter for the court. We do not represent otherwise, and any vendor who tells you their logs are guaranteed admissible is telling you something they cannot know.
What is not resolved
- Pakistan has no enacted data protection statute. The Personal Data Protection Bill remains in draft and contemplates localisation for health data. We follow the obligations in our privacy policy as binding on ourselves regardless.
- Venue and arbitration in our terms have not been settled by counsel.
- No independent penetration test by an external firm. Our own adversarial review found and fixed sixteen defects, six of which were introduced by earlier fixes in the same review.
- No production users and no clinical outcome data. Nothing here has run a real surgical list.