Tunisie
Online payment for clinics: Konnect and Flouci
Collect in dinar, online or at the counter, auto-reconciled with the invoice.
5 min read
A computerised patient record is a gain for care and a liability for whoever holds it. Health data sits among the most sensitive categories there are, and in Tunisia the personal-data authority is the INPDP. This article will not tell you what the regime asks of you — that is asked of the INPDP. It sets out what software has to do so that you can answer.
No software makes you compliant
The practice decides that a record exists, what goes into it and who may open it, and answers for those choices. The vendor hosts and operates the tool. Doctopass's INPDP declaration is submitted, and the product is GDPR-ready — the vendor's fact, not your exemption.
The consequence is direct, and it deserves to be stated by a vendor, because it is what a sales conversation quietly blurs. No software makes you compliant. A good one gives you the means — traceability, encryption, access control, export — and you remain the person who has to explain the decision.
So this article publishes no list of what the INPDP requires of you: not a filing, not a deadline, not a form. A vendor who invents them is worse than a vendor who stays silent. Verify that with the INPDP, then have your vendor write down what it carries.
What the record has to hold
Patient records with an eleven-section medical history are on all three plans, and so is the consultation workspace holding symptoms, notes, diagnosis and treatment. The record carries consultations, imaging, labs, medications, allergies, conditions, family history and vaccinations.
A record is not a pile of reports. It earns its place by answering, in one movement, the questions asked before prescribing — which is why it opens as a drawer beside the consultation rather than as another screen to switch to.
The practical test does not change. The patient sits down and you have thirty seconds: do you see the allergies, the current treatments and what happened last time, without leaving the screen you are on? If yes, the record works for you. If no, it works against you, and you will end up asking the patient for something you already hold.
Encryption, deletion, export
The most sensitive categories — mental health and other protected data — are encrypted at the field level with separate keys, isolated from the rest of the record. Personal data is encrypted in transit and at rest, and stored files are reached only through short-lived signed URLs.
The point of field-level encryption is containment: an incident in one part of the system does not expose the most delicate part. Deletion follows the same instinct. Patient data is never hard-deleted; an erasure request is honoured through an accountable soft delete that restricts access while a retention obligation subsists, so the record stays recoverable and auditable instead of vanishing without trace.
Export is the other half of that guarantee. A full record exports as structured JSON with the generated PDFs, on request — the wording is deliberate, and a vendor promising instant self-service should be asked to show the screen. It answers a patient who wants a copy, and it lets you leave for another vendor with everything. Consent is versioned and time-stamped, so what the patient agreed to and when is a matter of record rather than of memory.
Retention is where an article should stop talking. The period Doctopass applies in its own service is written in the privacy policy; the period binding you as a practitioner is verified with the INPDP. The two have to be compatible, a question for before signature.
Who opened this record
The full audit trail records every read and every write of patient data, cross-doctor access included, and it is available to the responsible doctor. It is a plan gate rather than a given: the full trail starts at Pro, and the search and investigation interface is Premium.
| Capability | Essential | Pro | Premium |
|---|---|---|---|
| Full audit trail | No | Yes | Yes |
| Audit log search and investigation interface | No | No | Yes |
The lines read in plain language — who viewed a record, and when — so a patient's question about who has seen their file is answered from a log rather than from memory. That difference, and not a count of minutes saved, is the whole argument for an audit trail.
Colleagues are the case people get wrong. A doctor other than the one who created a record can open it only where the patient has given explicit, per-doctor, revocable consent, and every such access lands in the trail. It is not access that expires on a timer; it is access the patient can withdraw whenever they choose.
The secretary is the other case. Permissions are granted one by one, each individually toggled and individually logged — manage the calendar, create invoices, view clinical notes, message patients — and every read and write lands in a per-secretary trail. Essential carries one secretary seat, Pro three, Premium five. How many people can open a given record is arithmetic to run yourself: the doctors, the seats the plan carries, and every colleague ever consent-gated in. More in delegating to a secretary.
Where the data sits
For the Tunisian service, physical hosting is within Tunisia. All AI processing runs on a model self-hosted by Doctopass within the applicable jurisdiction, and no personal data is transmitted to any external artificial-intelligence provider or third-party model.
Personal identifiers are stripped before any prompt leaves Doctopass servers: the model sees the clinical picture, not the patient's identity. Every AI output is a draft — the doctor reviews it and signs it before anything enters the record, with no automatic finalisation and no silent write.
Access is need-to-know, enforced twice on every read: a role-based guard, then a per-record ownership and permission check in the service layer. Under those sit argon2id password hashing, TOTP two-factor authentication, short-lived JWTs, rotated refresh tokens and session anomaly detection. The model is documented on the security and compliance page.
The limit is worth naming out loud. The software can prove who opened a record; it cannot decide what you are required to keep, or for how long, or what to do on the day something goes wrong. We would rather write that limit down than let it be discovered after signature.
Key takeaway
Encryption, soft delete, export and the audit trail are the four things to test in a demonstration, on a real record and not a sample. Note the gate while comparing vendors: the full audit trail starts at Pro, and searching it is Premium. Doctopass gives you the means and the evidence; it does not make you compliant.
Frequently asked
Does this software make me compliant?
No, and be wary of anyone who says otherwise. Software supplies means; responsibility stays with the practice that decided what the record holds and who may open it. What the framework obliges you to do is verified with the INPDP, and it is best handled as a step of the project in its own right, like the data migration.
Can a patient get a copy of their record?
Technically yes: a full record exports as structured JSON with the generated PDFs, on request. The form the request must take, and the time you have to answer, is verified with the INPDP rather than with a vendor.
Who else can open a record besides me?
The secretary, within permissions granted one by one and each of them logged, and a colleague only where the patient has given explicit, revocable, per-doctor consent. Both land in the audit trail, which is why the question has an answer at all.
What does this cost per doctor?
Essential is 69 DT, Pro 159 DT and Premium 269 DT, per doctor per month, billed annually, after a 14-day free trial, with patients free and unlimited on every plan. Encryption, soft delete and export sit on all three; the full audit trail starts at Pro and audit-log search is Premium. See the pricing page.
A record you cannot account for is a liability, not an asset. To walk the data flow, the encryption model and the audit trail on a real case, request a 30-minute demo — and bring the question you would least like to be asked about who has seen a patient's file.