Security and privacy
GDPR and HIPAA compliant. ISO 27001 and 9001 certified.
Built and hosted in the EU. We provide the documents your DPO will ask for.
Compliance
Standards we meet.
GDPR
Learner data handled as special-category data (Article 9).
HIPAA
Handled as protected health information. BAAs for US teams.
ISO 27001
Certified, independently audited information security.
ISO 9001
Certified quality management for build, release and support.
Documentation
What we send for your privacy review.
Provided during evaluation.
- Data-processing agreement (verwerkersovereenkomst), ready to sign
- Sub-processor list
- DPIA support for special-category child data
- EU hosting and data-residency statement
- Privacy policy and security overview for your DPO
- Business associate agreement (BAA) for US teams
- ISO 27001 and ISO 9001 certificates on request
Controls
How learner data is handled.
- All learner data stored and processed in the EU
- Learner profiles controlled by your clinical team and admins
- Separate roles for staff, supervisors, admins, tutors and caregivers
- Practice data treated as sensitive learner data
- Only the data needed for clinical review is collected
- Admin tools for clinics, telehealth teams, schools and larger organizations
Before rollout
What to agree on first.
- Signed DPA and privacy review
- DPIA, if your organization requires one
- Roles, permissions and site administration
- Hardware and network setup
- Parent or guardian consent, where required
- HIPAA (BAA) and FERPA for US service models
- Who owns implementation and support internally
Next step
Send us your privacy and procurement questions.
DPA, DPIA support, sub-processor list and BAA are ready for review.