Security & trust
Healthcare-grade privacy, fintech-grade controls
Security is a product requirement, not a feature. WALA handles prescriptions, diagnoses, insurance data and medication history as sensitive personal data under Ghana's Data Protection Act 843.
Minimum-information matching
Pharmacies are never sent a patient's medical record to answer a stock question. They receive only what is needed to judge whether they can fulfil, and dispensing detail is released after selection.
- Need-to-know release at each step
- Riders never see diagnosis or clinical notes
- Reports exclude unnecessary clinical information
Access control
Role-based access with least privilege, enforced in the database itself through row level security and organisation-level tenant isolation.
- Roles held in a dedicated table, never self-assigned
- Server-side authorisation on every privileged action
- Multi-factor authentication for privileged users
Immutable audit
Who viewed a prescription, who approved a pharmacy, who accessed insurance data and who changed settlement details are all recorded permanently.
- User, organisation, action, resource and reason
- Timestamp, IP address and session
- Old and new values on change
Regulatory alignment
Electronic pharmacy operation is restricted to licensed retail pharmacies, medicines are checked against FDA Ghana registration, and high-risk processing is assessed before launch.
- Pharmacy Council licence and ePharmacy authorisation verification
- FDA registration number and expiry on every medicine
- Data protection impact assessment for sensitive processing
Platform hardening
Secrets never reach the browser. Privileged logic runs server-side with rate limiting, signed storage URLs and webhook signature verification.
- Encryption in transit and at rest
- Session expiry and refresh-token rotation
- Secure file upload validation
Patient rights
Consent is explicit and versioned, access history is visible, data export is available and account closure follows a secure deletion workflow.
- Purpose limitation
- Retention rules
- Breach response capability