Confianza y cumplimiento
Privacidad y seguridad, con un estado honesto.
Los datos de salud son los más sensibles que existen, y así los tratamos. Cada marco de los que siguen tiene una página propia, escrita para revisiones de cumplimiento y compras, con documentación disponible bajo petición.
Lo que existe hoy
No third-party certification is held today. Statuses are self-declared.
- Implementado2de 8
Integrado en el producto y funcionando hoy.
- End-to-End Encrypted
- Zero-PII Analytics
- Autoevaluado2de 8
Nos hemos evaluado nosotros mismos. No ha habido auditoría externa.
- GDPR
- HIPAA
- En camino4de 8
En nuestra hoja de ruta. Aún no lo tenemos.
- FHIR-aligned status model
- ISO 27001
- SOC 2 Type II
- NHS DSP Toolkit
GDPR
Desha.ai processes personal and health data in line with the EU GDPR (2016/679) and the UK GDPR / Data Protection Act 2018. Processing is consent-governed and purpose-limited, data subjects can exercise their rights at any time, and we operate as a processor under Article 28 terms for our healthcare customers.
HIPAA
Desha.ai self-assesses its workflows against the HIPAA Privacy, Security and Breach Notification Rules, for US covered entities and their business associates. We will sign a Business Associate Agreement (BAA), apply the Security Rule’s administrative, physical and technical safeguards to Protected Health Information (PHI), and honour the minimum-necessary and breach-notification requirements. (HIPAA has no government “certification”; conformance is demonstrated through the BAA and our control attestations.)
NHS DSP Toolkit
For engagements that touch NHS patient data, Desha.ai aligns to the Data Security and Protection (DSP) Toolkit, the annual self-assessment against the National Data Guardian’s ten data-security standards. Our controls are designed to meet the “Standards Met” threshold.
ISO 27001
Desha.ai operates an information-security programme aligned to the ISO/IEC 27001:2022 control set (Annex A) and a risk-based Information Security Management System (ISMS). Formal certification is on our roadmap; today we map our controls to the standard and can share that mapping.
End-to-End Encryption
All Desha.ai data is encrypted in transit and at rest. Sensitive health and identity fields receive additional protection, and cryptographic keys are managed through a controlled lifecycle.
Zero-PII Storage
Desha.ai is built on data minimisation. Directly identifying information is segregated from health data, tokenised wherever possible, kept out of logs and analytics, and never used to train third-party models. We call this our Zero-PII principle: the analytics, monitoring and model layers operate on de-identified data.
SOC 2 Type II
Desha.ai is working toward a SOC 2 Type II report against the AICPA Trust Services Criteria. We are building the control environment a Type II opinion requires. No auditor is engaged and no observation period has begun; we hold no SOC 2 report today. We will publish here if and when that changes.
FHIR-aligned
Our internal activity and delivery status vocabulary is aligned to the HL7 FHIR task and event statuses. We do not yet ship a FHIR API, resource serialisation or SMART-on-FHIR authorisation; interoperability with EHRs is work we are heading toward, not something you can use today.
Estas páginas resumen la posición de Desha.ai para revisiones de diligencia debida. Son informativas, no revelan sistemas internos y no constituyen garantía ni asesoramiento jurídico. Las condiciones contractuales se recogen en nuestro DPA / BAA. No third-party certification is held today. Statuses are self-declared.