Confiance et conformité
Confidentialité et sécurité, avec un statut honnête.
Les données de santé sont les plus sensibles qui soient, et nous les traitons comme telles. Chaque cadre ci-dessous dispose d'une page dédiée, rédigée pour la revue de conformité et d'achat, avec documentation disponible sur demande.
Ce qui est en place aujourd’hui
No third-party certification is held today. Statuses are self-declared.
- Mis en œuvre2sur 8
Intégré au produit et en service aujourd’hui.
- End-to-End Encrypted
- Zero-PII Analytics
- Auto-évalué2sur 8
Nous nous sommes évalués nous-mêmes. Aucun audit externe n’a été réalisé.
- GDPR
- HIPAA
- En cours4sur 8
Sur notre feuille de route. Nous ne l’avons pas encore.
- FHIR-aligned status model
- ISO 27001
- SOC 2 Type II
- NHS DSP Toolkit
GDPR
Desha.ai processes personal and health data in line with the EU GDPR (2016/679) and the UK GDPR / Data Protection Act 2018. Processing is consent-governed and purpose-limited, data subjects can exercise their rights at any time, and we operate as a processor under Article 28 terms for our healthcare customers.
HIPAA
Desha.ai self-assesses its workflows against the HIPAA Privacy, Security and Breach Notification Rules, for US covered entities and their business associates. We will sign a Business Associate Agreement (BAA), apply the Security Rule’s administrative, physical and technical safeguards to Protected Health Information (PHI), and honour the minimum-necessary and breach-notification requirements. (HIPAA has no government “certification”; conformance is demonstrated through the BAA and our control attestations.)
NHS DSP Toolkit
For engagements that touch NHS patient data, Desha.ai aligns to the Data Security and Protection (DSP) Toolkit, the annual self-assessment against the National Data Guardian’s ten data-security standards. Our controls are designed to meet the “Standards Met” threshold.
ISO 27001
Desha.ai operates an information-security programme aligned to the ISO/IEC 27001:2022 control set (Annex A) and a risk-based Information Security Management System (ISMS). Formal certification is on our roadmap; today we map our controls to the standard and can share that mapping.
End-to-End Encryption
All Desha.ai data is encrypted in transit and at rest. Sensitive health and identity fields receive additional protection, and cryptographic keys are managed through a controlled lifecycle.
Zero-PII Storage
Desha.ai is built on data minimisation. Directly identifying information is segregated from health data, tokenised wherever possible, kept out of logs and analytics, and never used to train third-party models. We call this our Zero-PII principle: the analytics, monitoring and model layers operate on de-identified data.
SOC 2 Type II
Desha.ai is working toward a SOC 2 Type II report against the AICPA Trust Services Criteria. We are building the control environment a Type II opinion requires. No auditor is engaged and no observation period has begun; we hold no SOC 2 report today. We will publish here if and when that changes.
FHIR-aligned
Our internal activity and delivery status vocabulary is aligned to the HL7 FHIR task and event statuses. We do not yet ship a FHIR API, resource serialisation or SMART-on-FHIR authorisation; interoperability with EHRs is work we are heading toward, not something you can use today.
Ces pages résument la posture de Desha.ai pour une revue de due diligence. Elles sont informatives, ne divulguent aucun système interne et ne constituent ni une garantie ni un conseil juridique. Les conditions contractuelles figurent dans notre DPA / BAA. No third-party certification is held today. Statuses are self-declared.