How Enamela keeps your clinic's data safe

What we protect and how

Your clinic's data — patient records, charts, bills, prescriptions — is encrypted in transit, so it can't be read as it moves between your device and our servers, and encrypted at rest, so it's protected on the servers that store it. Enamela is hosted on Supabase (Postgres) and Vercel, both of which run their own security programmes for the infrastructure layer, on top of which we apply our own access controls.

We take daily backups of your clinic's data, so a technical failure doesn't mean losing your records, bills or history. Backups are stored separately from the live database and are part of our regular operations, not something you need to set up yourself.

Who can see what, inside your clinic

Enamela uses role-based permissions: an owner, doctor, receptionist and accountant each see only what their role needs. A receptionist can book and bill without seeing another doctor's private notes; a doctor sees their own patients' charts; only an owner or a role you choose can see combined numbers across branches. You control who on your team has which role from your clinic's settings.

Every clinic's data is kept separate from every other clinic on Enamela. Staff at one clinic, or one branch, cannot see another clinic's or branch's patients, bills or records unless you've explicitly given them access to more than one location.

If our team ever needs to look at your data

Enamela's support team does not browse into your clinic's data by default. If we ever need access to help with a support request or investigate an issue, we ask for your consent first, and that access is recorded in an audit log you can review, along with what was accessed and by whom. You can approve, reject or end that access from your clinic's data access settings at any time.

Where your data is stored

Enamela is a new product, launched in 2026, and we do not currently hold formal security certifications such as SOC 2, ISO 27001 or HIPAA. We're building our practices to a high standard from day one and will share updates here as that work matures.

Data region choices for clinics in Saudi Arabia and the UAE are still being finalised; if data residency in a specific country matters for your clinic, contact us and we'll tell you what's currently possible.