Security and compliance
What an institution should know before entrusting its tumor boards to OncoRoom: the legal framework, who has access, what is traced, whose data it is.
Legal framework
Algerian law on personal data.
OncoRoom is designed so that your institution handles its tumor board cases in compliance with the law on the protection of personal data. Health data is sensitive data there: everything that follows derives from this.
Law no. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data.
Your institution remains the data controller
It decides who has access to cases and for what.
Unimed acts on your behalf
As processor, within a framework set by contract before go-live.
Data is hosted in Algeria
Cases, documents, reports and backups.
Access
Who sees what, and which actions require re-authentication.
Mandatory two-factor authentication
For every role that sees clinical data. Backup codes are provided.
Re-authentication for sensitive actions
Signing a report, exporting data, changing a role.
Roles per tumor board
A surgeon on the senology tumor board does not see the cases of the thoracic oncology tumor board. A referring physician only sees the reports of the patients they referred.
An administrator without clinical access by default
They manage accounts and tumor boards, with no access to clinical data by default.
Time-limited sessions
Expiry after inactivity, maximum session length, account lock after several failed sign-in attempts.
| Action | Coordinator | Tumor board member | Presenting physician | Secretariat | Referring physician | Auditor | Administrator |
|---|---|---|---|---|---|---|---|
| Create a case | Yes | Yes | Yes | Yes | No | No | No |
| View the tumor board’s cases | Yes | Yes | Their own | Yes | No | No | No |
| Validate a case, add it to the agenda | Yes | No | No | No | No | No | No |
| Run the meeting, validate the decision | Yes | No | No | No | No | No | No |
| Sign the report | Yes | No | No | No | No | No | No |
| Read the report | Yes | Yes | Their own | Yes | Their patients | No | No |
| View the indicators | Their tumor boards | No | No | No | No | Yes | Yes |
| View the audit log | No | No | No | No | No | Yes | Yes |
| Manage users and tumor boards | No | No | No | No | No | No | Yes |
Traceability
What is recorded, and who can view it.
Views and changes
Recorded: every view of a case or a report, every change, every sign-in, every export and every role change.
A log that cannot be rewritten
Entries can be neither modified nor deleted.
Viewable by your institution
Your institution’s administrator and auditor filter and export the log, written in plain language.
No medical data outside the application
Neither in emails nor in notifications. An email only indicates that a report is available.
Backups
Where they are kept.
In Algeria, like the data
Backups are kept in Algeria.
Your data
It remains your institution’s.
A space of your own
No other institution sees your patients, your cases or your reports.
Exports at your initiative
Lists and indicators as CSV, reports as PDF.
Return at the end of the contract
A complete export is handed over to the institution.
Signed, frozen reports
A correction creates a new version; the old one stays available.
The Unimed team
It operates the platform without reading the cases.
No permanent access
The Unimed team has no permanent access to an institution’s clinical data.
Support access that you approve
Requested by an engineer, approved by your administrator, time-limited, read-only by default.
Visible, traced access
A banner warns your users during the support session. Every action appears in your audit log.
Go-live
Nothing to install.
In the browser
OncoRoom is used on a hospital workstation, a laptop or a tablet, with no software to install.
An administrator in your institution
They invite users, create tumor boards and assign roles.
Frequently asked questions
The questions an IT department or a data protection officer asks.
In Algeria, backups included.
Not without your agreement. Support access is requested by an engineer, approved by your administrator, time-limited, and every action appears in your log.
A neutral sentence and a link, for example “A tumor board report is available”. No patient data.
No. OncoRoom is used in the browser.