Use only what the task needs.
A claim-status check needs far less information than a clinically supported appeal. Each task gets a defined purpose and a smaller, relevant view of the record.
Privacy & security
Patient records protected.
Revenue work moving.
Claims, prior approvals, denials and AI-assisted follow-up all involve sensitive information. sehaXG is designed so each task uses only what it needs, stays within approved boundaries and leaves the healthcare team in control.
See how it works Limited access Approved AI use Human oversight
Patient trust
What that means in practice
Useful AI. Carefully bounded data.
Better revenue work should never require open access to a patient's history. These three principles shape every workflow.
Protect it wherever it goes.
Hosting, support, backups and AI services are part of the privacy review. Access, retention and any transfer are approved before live records use that route.
Keep people accountable.
AI can gather evidence and prepare a response. Clinicians and authorised staff remain responsible for uncertain clinical content, important decisions and approvals.
Follow the work
What an AI-assisted task can—and cannot—do.
See how claims, prior approvals, denials and digital agents can use patient information for a specific job without taking control away from the healthcare team.
Purpose-limited patient-data accessWorkflow examples
01 / USE WHAT IS NEEDED
Only what the task needs.
- Claim and permitted identifiers
- Relevant coding and coverage
- Approved supporting documents
02 / ASSIST WITH THE TASK
Check and prepare the claim
Access stays tied to this task, the approved tools and the intended recipient.
03 / REVIEW & RECORD
A team member reviews the submission
Approved claim package + action history
Why this matters
Checking a claim should not expose an entire medical record. The team uses the details and evidence needed for that claim and its approved destination.
AI follows the same privacy rules.
Before an external AI service can handle patient information, its purpose, location, retention, training terms, subprocessors and any transfer route must be approved.
Built for Bahrain
Privacy requirements become working boundaries.
Bahrain's Personal Data Protection Law treats health information as sensitive data. Healthcare rules also expect confidentiality and control over patient records. The right response is to make those duties practical in each organisation's workflow.
The sources below explain the legal foundation. The appropriate permissions, contracts and safeguards are confirmed for each live deployment.
A clear reason to use each record
Patient health information is sensitive data. Each claims, prior-approval or denial workflow needs an agreed purpose and an appropriate legal route for using the information. A technology contract is not, by itself, permission to use every part of a record.
Bahrain Personal Data Protection LawSensitive-data processing rulesThe hospital remains accountable
The healthcare organisation defines the work and who may access its records. Written processing terms set out the instructions, confidentiality duties and safeguards for any service handling data on its behalf. Requests about a patient's record are handled with the responsible organisation.
Bahrain Personal Data Protection LawNHRA private health facilities lawEvery destination is reviewed
The route for hosting, backups, support access and AI processing matters as much as the application itself. If information may leave Bahrain, the destination and transfer basis must be reviewed under Bahrain's rules before that route is used.
Cross-border transfer rulesBahrain Personal Data Protection LawProtection remains an ongoing duty
Access controls, traceable changes, retention, incident response and regular review turn privacy requirements into daily practice. The safeguards are checked against the actual organisation, workflow and providers—not treated as a one-time badge.
Technical and organisational safeguardsNHRA private health facilities lawProtection at every step
The safeguards behind the experience.
A secure workflow is more than a locked database. It covers what the task sees, who can act, how an AI service is used and what the team can review afterward.
The minimum necessary record
A status check can use a claim reference and permitted identifiers. A prior approval or appeal can use the supporting clinical evidence it needs. A task does not receive the entire record just because it is available.
Access with a reason
People and digital agents work within defined roles and approved tasks. Access to one organisation's records does not become access to another's, and a tool only receives the permissions required for its job.
Protected in storage and transit
Our live-deployment standard includes encryption, controlled exports, protected backups and a retention plan agreed with the healthcare organisation.
AI inside a controlled boundary
Any AI provider must be reviewed for permitted use, location, retention, subprocessors and onward transfers. Patient information is not an open-ended input for unrelated model training or experimentation.
People make consequential calls
AI can organise evidence, identify a possible gap and prepare a next step. Authorised staff review uncertain clinical content and approve consequential submissions or changes.
A record of what happened
The workflow is designed to show what was accessed, why it was needed, who approved an action and where information went—without filling logs with unnecessary patient detail.
In place today
What the product already does.
Live in sehaXG now, not a roadmap.
Where it is kept
Patient details and files are encrypted with your hospital’s own key.
Who can see it
Only people your managers add, in the role they gave them.
What is written down
Every record opened is logged, and the log can’t be edited.
What leaves the hospital
Nothing reaches a payer unless a person sends it.
The patient's rights
Erasure or a full report within one working day.
Checks that use a model
A model sees only what a check needs: no names, no CPR numbers.
The exact wording, as the app’s Help reads it
Where it is kept
- The database and the document store are reached only by this hospital's part of sehaXG.
- Names, CPR numbers, dates of birth, telephone numbers, policy and certificate numbers and the text of clinical notes are encrypted with a key that belongs to this hospital before they are written, so what is stored abroad is unreadable without that key.
- Uploaded files are encrypted with this hospital's key before they are stored, too.
- A copy of the database without the key shows none of them.
Who can see it
- Only accounts this hospital's managers created, with the role they gave them; a billing operator, a prior-auth clerk and a manager each see what their job needs.
- sehaXG's own operators open this hospital's records either through View as, which asks them for a reason, or by choosing the hospital in their own bar; every record they open is in this hospital's Access log under their name.
What is written down
- Every time someone opens a patient's record, downloads a file, exports a list or runs a check, sehaXG records who, when and which record.
- Managers see the log under Team access.
- It cannot be edited.
What leaves the hospital
- Nothing goes to a payer unless a person here sends it.
- When a check or a draft uses a model, sehaXG sends only the codes, dates and notes that check needs, calls the patient "Patient A", removes the CPR number, names and telephone numbers, and records on the record exactly which fields went.
The patient's rights
- A patient may ask the hospital what is held about them and have mistakes corrected.
- The hospital can ask sehaXG to erase a patient or for a full report of what is held, and has it within one working day.
Checks that use a model
- Nothing a model writes goes to a payer until a person here sends it.
How we make it real
Agree. Verify. Keep checking.
- 01
Agree the exact claims, denial, prior-approval and agent tasks, together with the hospital's instructions and legal basis for using patient information.
- 02
Map where records, backups and AI inputs go. Review providers, contracts, retention and any cross-border route.
- 03
Verify access boundaries, encryption, human approvals, audit records and incident response before live records are connected.
- 04
Review permissions, changes and unexpected activity as the workflow evolves, with named people responsible for action.
Talk to us
See the workflow.
Ask the hard privacy questions.
We can walk your clinical, revenue and privacy teams through the information a task needs, the points where people approve an action and the safeguards required before live use.
Request a demoFor privacy enquiries, contact legal@sehaxg.com. Please do not send patient records through the general enquiry form or email.