Enterprise Security. Zero Compromise.
Purpose-built for healthcare's most demanding compliance environments — from single-province Canadian clinics to global clinical research organizations operating under GDPR, HIPAA, and PIPEDA simultaneously.
Supported Compliance Frameworks
We support the full spectrum of North American and international healthcare data regulations, designed for organizations operating across multiple jurisdictions.
HIPAA
United States
Full Health Insurance Portability and Accountability Act compliance. PHI protected with end-to-end encryption, audit logging, and access controls. BAA available.
- Business Associate Agreement (BAA) available on request
- PHI encrypted at rest (AES-256) and in transit (TLS 1.3)
- Role-based access control with comprehensive audit trails
- Regular security assessments and penetration testing
PIPEDA
Canada — Federal
Personal Information Protection and Electronic Documents Act. Data hosted in Canadian Azure regions. Cross-border transfer controls. Privacy breach notification procedures.
- Canadian Azure data residency (Canada Central / Canada East)
- Consent management with full audit trail
- Privacy breach detection and notification procedures
- Individual access request handling procedures
PHIPA
Ontario, Canada
Personal Health Information Protection Act (Ontario). Specific controls for Ontario-based health information custodians and agents.
- Health information custodian compliance support
- Lockbox and consent management features
- Ontario privacy officer notification procedures
- PHIPA-aligned audit logging and access controls
GDPR
European Union
General Data Protection Regulation. Data Processing Agreements available. Lawful basis documentation. Right to erasure and data portability support.
- Data Processing Agreement (DPA) available on request
- Lawful basis documentation for processing activities
- Right to erasure and data portability workflows
- Cross-border transfer controls (SCCs available)
Deployment Models
Choose the deployment that fits your organization's IT policy, data sovereignty requirements, and security posture.
Multi-Tenant Cloud
Managed Azure Infrastructure
- Hosted on Microsoft Azure (Canadian or US region)
- 99.9% uptime SLA with proactive monitoring
- Automatic security patches and compliance updates
- Shared infrastructure with strict tenant isolation
White-Label
Your Brand, Our Infrastructure
- Custom domain and organizational branding
- Appears as an internal portal to patients and staff
- Still hosted on managed Azure infrastructure
- Branded documentation and patient communications
Self-Hosted Enterprise
Your Azure Subscription
- Full source code access with enterprise license
- Deployed on customer's own Azure/AWS subscription
- ARM deployment templates and IaC scripts provided
- Quarterly security patches + 6-month feature updates
- Supports air-gapped and zero-trust IT environments
Technical Security Controls
A comprehensive set of technical controls designed to meet enterprise and government security requirements.
AES-256 Encryption at Rest
All stored data encrypted using industry-standard AES-256 encryption
TLS 1.3 in Transit
All data transmissions encrypted with modern TLS protocols
Role-Based Access Control
Granular permissions: patients, nurses, PAs, physicians, admins, coordinators
Comprehensive Audit Logs
Every action logged with user identity, timestamp, IP, and action type
Multi-Factor Authentication
Enforced MFA for all administrative and clinical user accounts
Penetration Testing
Regular third-party penetration testing on a scheduled cadence
Vulnerability Management
Continuous scanning with critical patches applied within 24 hours
Data Residency Controls
Canadian Azure regions available; no cross-border transfer without consent
Tenant Isolation
Complete data isolation between organizations — no cross-tenant data access
Zero-Trust Architecture
Self-hosted option for air-gapped networks with no external dependencies
Key Vault Integration
Secrets managed via Azure Key Vault with customer-controlled access
Backup & Recovery
Automated backups with tested restoration procedures and RPO/RTO SLAs
Legal Agreements Available
Business Associate Agreement (BAA)
HIPAA-required agreement covering our responsibilities as a business associate handling PHI on your behalf.
Data Processing Agreement (DPA)
GDPR and PIPEDA-aligned agreement defining processing activities, purposes, and data subject rights.
Vendor Risk Assessment Package
Complete documentation package for enterprise procurement: security questionnaire responses, compliance certifications, and architecture diagrams.
Service Level Agreement (SLA)
Formal SLA including uptime guarantees (99.9%), response time commitments, and escalation procedures.
All agreements are available upon request to qualified organizations. Contact us during or after your demo to initiate the legal review process.
Questions about compliance for your organization?
Our implementation team will work through your specific compliance requirements on the demo call.
Book a Compliance Discussion →