NABIDH ready
Asttona is designed to support clinic workflows that are ready for NABIDH integration. We can discuss your interoperability requirements during procurement.
AsttonaBook a demo COMPLIANCE
Built around the rules your clinic answers to.
Asttona is designed to support aesthetic and dental clinics in meeting their health record and data protection obligations across the Gulf, the United Kingdom, Europe and the United States.
Frameworks we build against
United Arab Emirates
Federal Law No. 2 of 2019 on the use of ICT in healthcare and Federal Decree-Law No. 45 of 2021 on personal data protection, together with DHA and DoH requirements on record keeping, consent and health data held inside the country.
Gulf region
Saudi Arabia's PDPL and NPHIES-aligned record expectations, and equivalent health data rules in Qatar, Kuwait, Bahrain and Oman.
United Kingdom
UK GDPR and the Data Protection Act 2018, with clinical record retention aligned to CQC expectations for private clinics and dental practices.
European Union
GDPR, including lawful basis, explicit consent for health data, data subject rights and processor obligations under Article 28.
United States
HIPAA-aligned administrative, physical and technical safeguards for protected health information, with a Business Associate Agreement available to covered entities.
How obligations are shared
Our role
The clinic is the data controller for patient records. Asttona is the processor, acting only on the clinic's documented instructions.
Lawful processing and consent
Consent is captured, timestamped and stored against the visit it relates to, so a clinic can evidence the basis on which a treatment was performed.
Patient rights
Access, correction, export and erasure requests can be fulfilled from within the platform, with the audit history showing what was actioned.
Records retention
Retention periods are configured per clinic to match the rule in their jurisdiction, rather than a single global default.
Procurement documentation
Security questionnaires, the data processing agreement, subprocessor list and architecture summaries are provided on request during procurement.
Certifications
Asttona's technical controls are described in full on the security page, and our hosting providers operate under independently audited programmes such as ISO 27001 and SOC 2. Asttona's own independent certification status is shared directly with clinics during procurement — ask us and we will tell you exactly where we stand rather than imply more than we hold.