Compliance is not a feature. It is the architecture.
Egypt's Personal Data Protection Law (151/2020) classifies patient health information as sensitive personal data. Rubikcare was designed to that standard from the first line of code.
Eight requirements. One platform that meets them all.
How Rubikcare meets each PDPL requirement — from consent to erasure.
Written, explicit consent
Collected at registration on a standalone screen, timestamped, and withdrawable at any time.
Restricted access and audit log
Role-based access control on a least-privilege basis — every patient record access is logged in a tamper-proof audit trail.
Designated Data Protection Officer
Appointed and registered — a contact listed in every contract and available to any client compliance function.
Breach notification within 72 hours
Documented and tested procedure — regulator notified within 72 hours, affected individuals within 3 business days.
Secure hosting with data-location transparency
Data hosted in the European Union — aligned to global privacy standards (GDPR). Migration to in-country hosting within Egypt is planned.
Licensing for sensitive processing
Applications filed with the Personal Data Protection Center — status disclosed on request and in every presentation.
Data subject rights
Access, correction, objection, and withdrawal — available to the patient in the app and honoured within defined timelines.
Retention and erasure
Defined retention schedules per data category — erasure on consent withdrawal or retention expiry.
Adverse events are routed, not just collected.
Patient support programmes are a recognised source of adverse event information. On Rubikcare they are captured in a structured form and routed automatically to the client's PV function, aligned to EDA GVP.
Captured
Structured form — any touchpoint.
Routed
To your PV function within regulatory timelines.
Acknowledged
Complete audit trail retained.
Reconciled
Monthly report to your team.
Four principles govern every decision.
Compliance is not a checklist. It is how we operate every day.
Information security
Encryption in transit and at rest, penetration testing, vulnerability management, ISO 27001 in progress, and business continuity.
Tenant isolation
No pharmaceutical company sees another's data — enforced contractually and technically, subject to independent audit.
Anti-bribery & transparency
Programmes support patients prescribed on clinical grounds — nothing incentivises or rewards prescribing. Analytics do not rank individual physicians.
Data ownership
Data belongs to the sponsoring entity — full export at any time, and a source-code escrow option is available.
Questions every legal team asks.
Can another pharmaceutical company see our data?
No. Tenant isolation is enforced at the architecture level and restated contractually in every agreement, with no exceptions.
What happens to our data if we stop working with you?
It remains yours. Full export in open formats, on request, at any time. Retention or deletion follows your instructions.
Where is patient data hosted?
Patient data is hosted on secure servers in the European Union — aligned to GDPR and global privacy standards. Migration to in-country hosting within Egypt is planned.
Who is accountable if a breach occurs?
Defined clearly in the Data Processing Agreement (DPA). We notify you immediately so you can meet your regulatory obligations.
Will you complete our security questionnaire?
Yes. We send a security overview in advance to shorten the review window, and answer detailed questionnaires as needed.
The PDPL guide — 16 pages, no registration.
A practical guide written for compliance officers, not for marketing. It explains how Rubikcare meets each PDPL requirement in the operation of patient support programmes.