Trust & compliance
Health data security, privacy, and GDPR and HIPAA compliance
Healthcare organizations need confidence in how information is collected, processed, accessed, stored and governed.
Clarrio.ai treats security, privacy and interoperability as foundations of its architecture and research workflows.
Privacy and data governance
Principles for sensitive health information
- Lawful processing
- Each processing activity has a defined legal basis under the regulations that apply to it.
- Purpose limitation
- Data collected for one purpose is not reused for an unrelated one without an appropriate basis.
- Data minimization
- Programs collect what the question needs, not everything a device can record.
- Consent where required
- Participants are informed and consent is recorded where the purpose requires it.
- Access restrictions
- People see only the data their role and the purpose justify.
- Retention policies
- Data is kept for defined periods aligned with contracts and research protocols.
- Data subject rights
- Requests for access, correction and deletion are handled through a defined process.
- Contractual safeguards
- Data processing agreements set out roles, responsibilities and subprocessors.
- Cross-border transfers
- International transfers follow the mechanisms required by the applicable law.
Security architecture
Controls across access, data and operations
Select a control to read what it covers.
Access layer
Data layer
Operations layer
Access layer
Identity & authentication
How users and services prove who they are before reaching any data.
Controls are described here only once their implementation has been verified.
Cloud infrastructure
Built on Microsoft Azure
Clarrio.ai runs on Microsoft Azure. Deployment models, hosting regions and customer-specific configurations, including sovereign-cloud options, are agreed per deployment.
Interoperability and standards
Standards-based exchange
- HL7 FHIR
- A modern standard for exchanging healthcare data as structured resources such as Patient, Observation and Condition.
- HL7 v2
- The widely used messaging standard in many hospital systems, still common for labs and admissions.
- SMART on FHIR
- An approach for apps to launch within an EHR with the user's context and authorization, where the customer's EHR supports it.
- EHR integration
- Connections to Epic and Oracle Health environments, scoped with each organization's IT team.
- Data harmonization
- Mapping units, codes and time stamps from different sources onto one consistent longitudinal record.
- Enterprise exchange
- Exports and APIs for research and analytics teams.
Integration capabilities depend on each customer's systems and deployment requirements.
Regulatory and compliance framework
Regulatory and compliance responsibilities for health data
GDPR
Clarrio.ai is GDPR compliant. Processing responsibilities are defined with each customer according to their roles, purpose and applicable agreements. GDPR compliance is not a certification.
HIPAA
Clarrio.ai is HIPAA compliant. Programs involving US covered entities and protected health information require applicable business associate agreements and clearly defined responsibilities. HIPAA compliance is not a certification.
Research ethics
Research uses require the approvals the protocol needs, such as an ethics committee or IRB, obtained by the sponsor or institution.
Intended use
Clarrio.ai is a data and insight platform for research and program workflows. It is not a medical device and does not diagnose or recommend treatment.
Data residency
Where data is hosted depends on the deployment and customer requirements, including sovereign-cloud options.
Research-use positioning
Clarrio.ai’s research-use scope and clinical limitations
Clarrio.ai supports research-oriented health data collection, interoperability and analytics. It is not a medical device, and it is not an autonomous diagnostic or treatment-recommendation system. Clinical decisions remain with qualified professionals.
Enterprise trust resources
Request trust documentation
- Security overview
- Data Processing Agreement
- Privacy policy
- Technical architecture overview
- Data retention overview
- Subprocessor information
To request any of these documents, send an inquiry with your organization and the documents you need.
Request documentation