Your patients' data, protected and kept in Thailand
MORRU HIS keeps medical records in a Bangkok data centre, encrypted in transit and at rest. Your clinic decides who sees what, and we act as your data processor under Thailand's PDPA with a written agreement.
- Where data and files are stored
- Bangkok
- Every connection
- TLS 1.2+
- Stored files
- AES-256
- Breach notification
- ≤ 24 h
Where data lives and how it's encrypted
Everything runs on Amazon Web Services in the Bangkok region.
Data stays in Thailand
The database, files and backups are in Bangkok. Only features you choose to use, such as email reminders, video consultations and LINE, send data abroad, as listed in the DPA.
Encrypted in transit
Every connection uses HTTPS with TLS 1.2 or newer. Plain HTTP requests are redirected to HTTPS.
Encrypted at rest
The database is encrypted at the storage level, files with AES-256, and application keys are managed in AWS Key Management Service.
Backup and recovery
The database is backed up automatically and can be restored to any point in the last 7 days. Deleted or overwritten files can be recovered within 30 days.
Your clinic decides who sees what
Every permission is set from the Staff page in HIS.
Each clinic's data is separate
Users can only see data for the clinic account and branches they are granted.
Menu permissions by role
Doctors, nurses, front desk and cashiers see only the menus their work needs, adjustable per person.
Device lock and network limits
Advanced planAllow staff to sign in only from approved devices or from your clinic's network.
Activity history
Important changes to branches, staff, inventory and cases are logged with who and when, for administrators to review.
Passwords can't be read back
Passwords for staff, clinic accounts and MORRU app members are stored as PBKDF2-SHA256 hashes with 600,000 iterations and a unique salt per person. No one can read the original password, including the MORRU team. A forgotten password has to be reset.
Sign-in sessions you control
Sign-in sessions are stored server-side and can be revoked, and staff who leave can be removed immediately.
Patient files and documents
Patient files open only through the system.
Patient files are never public
Patient photos, attachments and result files cannot be opened with a direct link. They open through a signed-in session or a temporary link that expires.
Lab result links expire
Lab result PDF links work only for a short time, so a forwarded link stops working.
Video consultations aren't recorded
Video and audio during a consultation are streamed live and never stored.
No card data stored
Card details are entered directly with the payment provider and never pass through or stay in our system.
PDPA: you're the controller, we're the processor
Our duties are written in a Data Processing Agreement (DPA) under Section 40.
Data Processing AgreementWe act only on your instructions
We never sell or rent your data, or use it to train or build AI systems.
Breach notice within 24 hours
If a breach affects your data, we tell your account administrator within 24 hours with what you need to report to the PDPC.
Notice before sub-processor changes
Sub-processors are listed in the DPA, and we give at least 30 days' notice before adding or changing one.
Export and deletion when you leave
Data is never deleted automatically when you stop. You can export everything, and once you confirm deletion it is removed from the database immediately, with files and backups gone within 8 days and a deletion certificate issued.
What your clinic can do
Security is shared. These parts are in your hands.
One person, one account
Give every staff member their own account and never share passwords, so the activity history shows who did what.
Grant only what's needed
Open only the menus each role needs, and review permissions when someone changes jobs.
Remove leavers right away
Remove a staff member's account on their last day.
Look after your devices
Lock screens when stepping away, and don't save passwords on shared computers.
Need more detail for your risk assessment?
We can complete your clinic's security questionnaire and provide information for your data protection impact assessment.
Our Data Processing Agreement (DPA) sets out our duties, security measures and every sub-processor we use.