Compliance & Security
Your trust is our priority. We maintain the highest standards of data protection and regulatory compliance.
Our Certifications
HIPAA ComplianceIn Compliance
Security and privacy controls aligned with HIPAA requirements implemented
- ✓Administrative safeguards in place
- ✓Physical security controls implemented
- ✓Technical safeguards deployed
- ✓Audit controls and logging active
- ✓Awaiting formal certification
GDPR ComplianceIn Compliance
Data protection controls following GDPR requirements
- ✓Data subject rights mechanisms
- ✓Privacy by design principles
- ✓Data processing agreements
- ✓Security measures implemented
- ✓Formal certification targeted Q1 2026
PDPA ComplianceIn Compliance
Personal data protection aligned with PDPA standards
- ✓Consent management
- ✓Data protection practices
- ✓Access controls
- ✓Data retention policies
- ✓Compliance framework in place
ISO 27001 (In Progress)In Progress
Information security management system implementation underway
- ✓ISMS documentation completed
- ✓Security controls deployed
- ✓Risk assessment framework
- ✓Internal audit planned
- ✓Target certification: Q1 2026
Certification Status
Elderwise has implemented security and privacy controls aligned with healthcare compliance standards (HIPAA, GDPR, PDPA). While formal third-party certifications are in progress with targeted completion in Q1-Q3 2026, our systems already follow industry best practices for data protection and security.
Security Measures
Data Encryption
AES-256 encryption for data at rest and TLS 1.3 for data in transit
Access Control
Role-based access with multi-factor authentication and SSO support
24/7 Monitoring
Continuous security monitoring and threat detection
Backup & Recovery
Automated backups with tested disaster recovery procedures
Privacy Commitment
We are committed to protecting your privacy and giving you control over your data.
Healthcare Standards & Elderwise Compliance
Last Updated: 2025-09-27Health Insurance Portability and Accountability Act (HIPAA)
U.S. healthcare privacy and security law governing PHI.
Healthcare Relevance:
U.S. healthcare privacy and security requirements governing PHI handling by covered entities and business associates.
Key Requirements:
- Business Associate Agreements (BAAs)
- Role-based access and MFA
- Audit logging and monitoring
- Minimum necessary access
- Encryption in transit and at rest
- Breach notification procedures
- Periodic risk assessments and workforce training
How Elderwise Complies:
BAAs in place with processors, enforced RBAC/MFA/SSO, centralized audit logs, least-privilege defaults, AES-256/TLS 1.3 encryption, incident response runbooks, and recurring HIPAA training.
EU General Data Protection Regulation (GDPR)
EU data protection regulation covering lawful processing and rights.
Healthcare Relevance:
EU/EEA framework for data protection, lawful processing, and data subject rights.
Key Requirements:
- Lawful basis and consent management
- Data subject rights (access, erasure, portability)
- Data Processing Agreements
- Data Protection by Design and Default
- Records of processing activities
- International transfer safeguards
How Elderwise Complies:
Consent capture and audit trails, DPA addenda with vendors, privacy by design reviews, DSR workflows, and transfer impact assessments where applicable.
Personal Data Protection Act (PDPA, Singapore)
Singapore data protection law emphasizing consent and purpose limitation.
Healthcare Relevance:
Singapore data protection obligations for consent, purpose limitation, notification, and access/correction.
Key Requirements:
- Consent and notification
- Purpose limitation
- Access and correction rights
- Protection and retention limits
- Data breach notification
How Elderwise Complies:
Localized consent statements, retention schedules, access/correction channels, and breach notification procedures aligned with PDPC guidance.
ISO/IEC 27001 Information Security Management System
International ISMS standard for managing information security risks.
Healthcare Relevance:
International standard for establishing, implementing, maintaining, and continuously improving an ISMS.
Key Requirements:
- Risk management program
- ISMS governance and documentation
- Security controls per Annex A
- Continuous improvement cycle
How Elderwise Complies:
Formal ISMS scope definition, risk register, policies and control mapping, internal audits, and readiness for certification.
SOC 2 Type II (Security, Availability, Confidentiality)
Attestation of security controls effectiveness over a period (Type II).
Healthcare Relevance:
Attestation of control effectiveness over a review period per AICPA Trust Services Criteria.
Key Requirements:
- Documented policies and procedures
- Security monitoring and alerting
- Change and incident management
- Vendor risk management
How Elderwise Complies:
Control mapping to TSC, evidence collection automation, continuous monitoring, quarterly control testing, and external audit readiness.
HITRUST CSF
Healthcare-centric certifiable security framework harmonizing multiple standards.
Healthcare Relevance:
Healthcare-focused certifiable framework harmonizing HIPAA, ISO, NIST, and other requirements.
Key Requirements:
- Risk-based control selection
- Policy/procedure implementation
- Validation and scoring
- External assessment
How Elderwise Complies:
Scope definition for PHI systems, control inheritance where applicable, and staged readiness toward validated assessment.
Singapore HSA Guidance (Medical Technologies)
Singapore HSA guidance for medical technologies and software.
Healthcare Relevance:
Regulatory guidance for medical device software and health tech solutions in Singapore.
Key Requirements:
- Risk classification and documentation
- Quality management alignment
- Clinical and cybersecurity considerations
How Elderwise Complies:
Alignment with HSA advisories, documentation of intended use and risk controls; leverage ISO 14971/IEC 62304 where applicable.
HITECH Act (Breach Notification)
U.S. breach notification and enforcement enhancements to HIPAA.
Healthcare Relevance:
U.S. breach notification and enforcement enhancements to HIPAA.
Key Requirements:
- Breach risk assessment
- Timely notifications
- Media and HHS reporting thresholds
How Elderwise Complies:
Incident response runbooks, evidence preservation, decision trees for materiality and reporting timelines.
HL7 FHIR (Interoperability)
Modern interoperability standard for structured clinical data exchange.
Healthcare Relevance:
Modern healthcare interoperability standard for structured clinical data exchange.
Key Requirements:
- FHIR resources and profiles
- RESTful APIs and conformance
- Security and authorization (SMART on FHIR)
How Elderwise Complies:
FHIR-first data modeling for core entities, versioned profiles, and OAuth2/OpenID Connect for secure access.
HL7 v2/v3 Messaging
Healthcare messaging standards used by EHRs and labs.
Healthcare Relevance:
Legacy and current healthcare messaging standards widely used by EHRs and labs.
Key Requirements:
- Message formats and segments
- Ack/error handling
- Transport and security
How Elderwise Complies:
Adapters for HL7 v2.x integration where required, normalization to internal schemas, and secure transport.
ISO 13485 Medical Devices QMS
Quality management system standard for medical devices.
Healthcare Relevance:
Quality management standard for organizations involved in medical device lifecycle.
Key Requirements:
- Documented QMS
- Design and development controls
- Risk management and traceability
- Post-market surveillance
How Elderwise Complies:
Progressive QMS adoption for applicable software modules; align with regulatory pathways if device classification applies.
ISO/IEC 42001 AI Management System
AI management system standard for responsible AI governance.
Healthcare Relevance:
Framework for governing responsible AI systems across lifecycle.
Key Requirements:
- AI risk management and controls
- Data governance and transparency
- Monitoring and continuous improvement
How Elderwise Complies:
Map existing controls to AI risks, define KPIs and documentation for transparency, and institute model governance workflows.
Legal Documents & Compliance Materials
Data Protection & Security Contacts
Data Protection Officer:dpo@elderwise.ai
EU Representative (Art. 27 GDPR):eu-rep@elderwise.ai
APAC Representative:apac-rep@elderwise.ai
Security Team:security@elderwise.ai
Vulnerability Reporting:security-alerts@elderwise.ai
Certification Roadmap
Elderwise's phased certification timeline:
- Q3 2025: FHIR & HL7 interoperability certifications
- Q4 2025: GDPR compliance validation
- Q1 2026: ISO 27001 certification
- February 2026: ISO 42001 (AI Management System) certification
- Q2 2026: HIPAA, HITECH & HSA certifications
- Q3 2026: SOC 2 Type II & HITRUST CSF certifications
- Q4 2026: ISO 13485 certification & continuous compliance monitoring
Healthcare-Specific Security Features
- End-to-end encryption for all sensitive health information
- Multi-factor authentication for healthcare provider access
- Role-based access control aligned with clinical workflows
- Audit logging for all actions on protected health information
- Secure API design for healthcare system integrations
- Context-aware access controls for different care settings
- Session timeout controls for clinical environments
- Secure offline caching for emergency care scenarios
Healthcare Infrastructure Security
- Hosting in ISO 27001 certified data centers
- Region-specific data residency options for regulatory compliance
- Regular vulnerability scanning and penetration testing
- Disaster recovery with 99.9% uptime commitment
- Infrastructure as Code (IaC) for secure, consistent deployments
- Network segmentation for clinical vs. administrative data
- 24/7 infrastructure monitoring with healthcare-specific alerts
- Continuous security control validation using automated tools
Continuous Compliance Program
- Automated compliance monitoring tools
- Regular internal audits specific to healthcare requirements
- Vendor security assessment program for all third parties
- Compliance training for all staff, with healthcare-specific modules
- Quarterly security steering committee with clinical stakeholders
- Real-time compliance monitoring dashboard for leadership visibility
- Automated evidence collection to streamline certification maintenance
Healthcare Data Governance Framework
Data Collection in Healthcare Context
- Explicit consent mechanisms for patient data with healthcare-specific language
- Transparent data collection purposes aligned with clinical needs
- Minimized data collection following principles of medical necessity
- Special handling procedures for sensitive medical categories
- Patient-centric approach to data ownership and control
Healthcare Data Retention
- Retention policies aligned with medical record requirements by jurisdiction
- Secure, compliant data archiving for long-term medical records
- Automated data deletion when retention periods expire
- Special provisions for pediatric and geriatric record retention
- Data lifecycle management specific to clinical documentation standards
Clinical Data Processing
- Processing limited to intended healthcare purposes
- Secure analytics for population health insights
- De-identified data use for research and development
- Validation processes for algorithm-assisted clinical decision support
- Secure federated learning techniques for model improvements
Patient Data Rights
- Patient access to personal health information
- Correction mechanisms for inaccurate health data
- Data portability between healthcare providers
- Special handling for vulnerable populations and proxy access
- Transparent record of all third-party data sharing
Elderwise Healthcare Compliance Commitment:
Our compliance strategy follows Vanta's recommended "security by design" principles, embedding healthcare compliance requirements into our development process from inception to deployment. We recognize that healthcare data security directly impacts patient outcomes and provider efficiency, so our approach integrates technical safeguards with clinical workflow considerations to create a secure environment that enhances rather than impedes care delivery. Our compliance program emphasizes both regulatory adherence and the ethical responsibility we have to protect sensitive health information.