One page, written so you can say yes to a pilot without a meeting.
A self service screening unit with a touch screen, a blood pressure cuff, a scale and sensors. It runs a locked Windows shell with Abby's software. It connects outbound only and needs no login to your corporate systems. It can take an ID from an RFID, fingerprint or wave reader if you use one.
What data it collects. Name, ID or company number, mobile number, date of birth, gender, the vitals it measures, and the answers to the on screen questions. The worker gives consent on the screen before anything is stored. The consent text and time are kept for audit.
Abby sees: nothing. Abby keeps no data.
Best for: you run a clinic system with an API and do not need worker results or Abby reports.
Abby sees: remote support only, under your controls.
Best for: data must stay on site, but you want Abby's portal and reports. Adds some upkeep for your IT team.
Abby sees: a small operations team, least privilege access, logged. Each client sits in its own ringfenced tenant.
Best for: no kit to run, several sites, fastest to set up. Our preferred option.
Under options 1 and 2, no worker data leaves your network unless you switch on results to workers. That sends a time limited, tokenised link by WhatsApp, SMS or email to a results page backed by an encrypted store in Azure South Africa.
Sees their own results.
Sees each result, through your clinic system or the Abby clinical view, in line with your own access rules.
See team trends. Access is by role.
See data only to support the service, and this is logged.
HTTPS with TLS on every station and API channel, with its own API key for each station. TLS 1.2 is the minimum.
Disk encryption on the database server. Column level encryption has started on the most sensitive identifiers. Data held on the station waiting to send sits in a locked local store with no user access.
Staff sign in with single sign on and MFA. Access is least privilege and role based. Leavers are switched off by their last day.
Weekly full and daily incremental, AES 256 encrypted, kept in South Africa.
External test of our internet facing services by DotCom Cybersecurity, 16 July 2024. No hosts or credentials were compromised. Six low severity configuration findings. The summary report is available under NDA.
Documented breach reporting and response procedures. No breaches recorded to date.
What is next. We are moving the hosted platform to Microsoft Azure South Africa North, with Abby held encryption keys and a web application firewall in front of the station API.
QMed, TriMed, HealthOne and others
Live with QMed, TriMed and HealthOne, and others. QMed runs this way at Implats and Gold Fields. The station makes REST calls over HTTPS with an API key: it looks up and checks the patient, then posts the results back. Your system version is checked before install, because an older version can block it. We provide a technical design specification on your template and a UAT test case, as we did for Gold Fields.
Remote support. Over VPN, or by an outbound only support agent that needs MFA, agreed with your IT team. Or by a technician on site. Fault response times are set in each client's service agreement.
Abby Health is licensed by SAHPRA · Licence 1576/32354. This device has been licensed by SAHPRA. The device therefore complies with SAHPRA's minimum safety requirements, but its clinical efficacy has not been evaluated. CE marked and FDA cleared.
Built with POPIA in mind: consent before every check, results stored in South Africa. Health data is special personal information under POPIA and is handled as such. Our information security management system is built to ISO/IEC 27001:2022. We are working towards certification and are not yet certified.
Your data agreement sets who is responsible under POPIA: you, Abby, or shared. Every model includes purpose limits, disclosure of sub operators, breach notice, your right to audit, and return or destruction of data at the end.
A signed statement that Abby holds every certificate and policy listed above, with the documents themselves, the penetration test summary and the full architecture overview available under NDA.
Ask the Abby team at info@go-abby.co.za, or write to our security contact at DPO@go-abby.co.za.