- Home
- Guides
- Clinic software under Israeli law: what is really required, and how Levion answers each item
Guide
Clinic software under Israeli law: what is really required, and how Levion answers each item
An Israeli clinic holds the most sensitive data there is: medical information. Its management system is therefore not just a calendar and a patient file, it is part of the clinic's legal responsibility. This page lists the requirements that apply to every private clinic, shows exactly how Levion is built around each one, and says openly what is still in development. That way you can check us, and any other vendor.
Last updated: 2026-10-20
Four layers of regulation that apply to every private clinic
Privacy Protection Law and Amendment 13
Medical data is information of special sensitivity. Since 14 August 2025 the Privacy Protection Authority has real enforcement powers and fines. Our Amendment 13 guide covers the duties.
Data Security Regulations, 2017
A security level per database, and for a medical database: a security procedure, access control, access logging, backups, and handling and reporting of security incidents.
The medical record and patient rights
The Patient's Rights Law and the Public Health (Medical Records) Regulations: documenting treatment, keeping the record for many years, and the patient's right to receive their medical information.
Tax Authority: Israel Invoice
Above a set amount, a tax invoice needs an allocation number from the Tax Authority so the patient or customer can offset it.
How Levion answers each requirement
This is not a list of slogans. Every row is something that exists in the system today and can be seen in a demo.
| Requirement | What it means in practice | How it is built in Levion |
|---|---|---|
| Data kept in Israel | Where the database and files live | Google Cloud, Israel region (Tel Aviv): the database, files and documents. The sub-processor list is public on the site. |
| Encryption | At rest and in transit | AES-256 encryption with keys under our control for the database, files, secrets and logs. All traffic is encrypted with TLS, including the database connection. |
| Separation between clinics | One clinic never sees another's data | Separation is enforced inside the database (Row Level Security), not only in code. Even an application bug cannot expose another clinic. |
| Access control | Each staff member sees only what they need | Roles (owner, manager, doctor, reception and more), plus personal permissions the clinic manager sets for each staff member: contact details, medical file, finance. Also enforced in the database. |
| Logging access and changes | Who viewed, who changed, and when | An append-only audit log, with no editing or deleting, alongside Google Cloud's access logs. |
| Authentication | Only the right user gets in | Passwords of at least 10 characters, two-step sign-in (Authenticator app or e-mail code, the clinic chooses), automatic sign-out after inactivity, protection against guessing and password reset by single-use link. |
| Backups | Recovery after a failure | Automatic daily backups and point-in-time recovery for the last 7 days, stored separately from the live database. |
| Keeping the medical record | A medical file is not deleted | The medical record cannot be deleted. A patient is archived, and a legal hold can be placed. |
| Patient erasure request | Right to correction and deletion without breaking the retention duty | A clear process for the clinic manager: delete contact and marketing data, or refuse with recorded grounds. The medical record is kept and everything is logged. |
| Consents | Recording what the patient agreed to | Consent forms with a stored version and timestamp. Messages go only to patients who agreed. Recording a visit requires a recorded consent. |
| Prescriptions | Under the Physicians' Prescription Regulations | Only a doctor issues a prescription. It prints with a signature line and stamp box, to be handed over as a signed original. Dangerous drugs are not prescribed through the system. |
| Israel Invoice | Allocation numbers from the Tax Authority | Invoices are issued through licensed invoicing providers the clinic connects: Morning (GreenInvoice), iCount and Invoice4U. |
| Security incident | Detection, handling and reporting | A written response procedure. The clinic is notified within 24 hours under the agreement, and the Privacy Protection Authority is notified as the regulations require. |
| Data processing agreement | What the vendor may do with the data | A processing agreement is signed with every clinic. Levion staff are structurally blocked from medical files and see aggregates only. |
Why Levion is a safe choice for an Israeli clinic
Built in Israel, for Israeli clinics
Hebrew from day one, data kept in Israel, connected to Israeli invoicing providers, and Amendment 13 as the starting point of the design, not a late add-on.
Security lives in the database
Separation between clinics, per-staff permissions and an unchangeable audit log are enforced inside the database, so even a code mistake does not open a door.
The clinic stays in control
The clinic manager decides who sees what, whether two-step sign-in is on and how long a session stays open. Every access to a file is logged.
Ready for a privacy review
A written security procedure and incident-response procedure, a signed processing agreement and a public sub-processor list. When the privacy adviser asks, the answers are ready.
Levion is designed to meet the requirements of the Privacy Protection Law, Amendment 13 and the Data Security Regulations, and every row in the table above can be seen in the system itself. The clinic gets one management system that both saves time and protects its patients' medical information.
What is coming next
- Audit report screen for the clinic: search by patient, staff member, action and date, with CSV and PDF export. The log itself is already recorded today; the screen is on the way.
- Full export of the clinic's data: patients, appointments, documents and invoices, in one file, at any time.
- Digital-signature evidence package: SMS code verification, timestamp, document version and device details for every consent and every signed price offer.
7 questions to ask every vendor before you choose
Where is the data kept, and with which sub-processors?
Ask for a cloud provider, a region and a written sub-processor list. "A secure cloud" is not an answer.
How are clinics separated from each other?
Separation in the database is sturdier than separation in code alone. Ask what happens if there is a bug.
Can the audit log be changed?
A log an administrator can edit or delete proves nothing. Ask to see how it is stored.
Who on your team can see the medical files?
The right answer: nobody, without your explicit permission.
What happens when a patient asks to delete their data?
You need a process that respects the request and the duty to keep the medical record, and records the decision.
How do we leave if we want to?
Ask in which format you get the data, how fast, and whether it costs money.
Is there a data processing agreement?
The clinic owns the database and the vendor processes data on its behalf. Without a written agreement, your duty is not covered.
FAQ
Is Levion approved by the Ministry of Health?
The Ministry of Health keeps no registry of approved clinic management software, so no vendor can be "approved". Levion is designed to meet the requirements of the Privacy Protection Law and Amendment 13, the Data Security Regulations and medical-record law, and we show how in every demo.
Where is the clinic's data stored?
In Google Cloud, Israel region (Tel Aviv): the database, files and documents. The sub-processor list, for example for SMS and e-mail delivery, is on the site's sub-processors page.
Can Levion staff read medical files?
No. Platform staff are structurally blocked from patient data and see aggregates only. Every access is logged.
Can a patient be deleted?
The medical record is not deleted, because the law requires keeping it. The patient is archived. If a patient asks for erasure, the clinic manager deletes contact and marketing data or records a reasoned refusal, and the action is logged.
How do tax invoices work?
The clinic connects a licensed invoicing provider (Morning, iCount or Invoice4U), and invoices, including Israel Invoice allocation numbers, are issued through it.
Is there two-step sign-in?
Yes. The clinic chooses whether to turn it on and how: an Authenticator app or an e-mail code. There is also automatic sign-out after inactivity, and the clinic manager sets the session length.
This page is general information, not legal advice. Each clinic's duties depend on its size, its database and the treatments it gives, so check them with a privacy adviser. Want to see every row of the table in the system itself? Book a demo and we will go through it together.
Want to see it up close?
Book a personal demo — we'll walk through your own clinic's scenarios together.