The short version. Healthplex is deployed on infrastructure you control. Patient data stays inside your network — there is no Healthplex cloud holding it, which removes an entire class of vendor risk from your assessment. What remains is the security of the software itself, and how we behave when you ask us for help. Both are documented below.
Where your data lives
On your hardware, inside your network. We do not hold a copy.
The default and recommended deployment model is self-hosted: the platform runs on servers your organisation owns or leases, on your own network, behind your own firewall. It is capable of running fully air-gapped, including the AI features, which use local models by default.
The practical consequences for your risk assessment:
- No vendor-held patient data. Healthplex cannot disclose, lose or be compelled to produce records it does not possess.
- Residency is your decision. Data sits wherever your servers sit — no region selection to configure, no cross-border transfer to paper over.
- No shared multi-tenant blast radius across organisations, because your deployment is yours alone.
- Infrastructure controls are yours. Physical security, network segmentation, OS patching, backup and disaster recovery sit with your team. We publish hardening guidance and ship secure defaults, but we cannot operate what we cannot see.
Where an organisation asks Healthplex to operate the deployment instead, the Data Processing Addendum and a HIPAA Business Associate Agreement govern that processing, and the obligations in this page's Platform controls section apply to us directly.
Platform security controls
The controls below are implemented in the product and verified in the build pipeline, not aspirational.
Audit logging Enforced
Every read of patient data is audit-logged with actor, subject, purpose and timestamp. Logging is not an optional module — it is a build-level requirement.
Tenant isolation Enforced
Every query carries an org_id scope. Isolation is asserted by automated tests that fail the build if a query can escape its tenant.
RBAC + ABAC Enforced
Fine-grained, permission-based access control with attribute conditions, and a break-glass path that is time-limited, logged and alerted on.
Token handling Enforced
OIDC sign-in with tokens issued in HttpOnly cookies. Never localStorage, so a cross-site scripting bug cannot exfiltrate a session.
Encryption Enforced
TLS 1.2+ in transit throughout. Encryption at rest for database and object storage. Tenant AI credentials protected with envelope encryption.
Secure development Enforced
Mandatory peer review; static analysis, dependency, secret and container scanning in CI; null-safety and module-boundary verification at build time.
Forward-only migrations Enforced
Schema changes are versioned and forward-only. Applied migrations are never edited, so a deployment's data history stays reconstructable.
Kill switches Enforced
Every new capability — AI features especially — ships behind a feature flag that an administrator can disable immediately without a redeploy.
Compliance posture
Engineered against these frameworks. Independent certification status is stated honestly below.
Healthplex implements a region-aware compliance layer: every layer that touches patient data respects the active profile, so one codebase serves several regulatory markets without forking. That is an architectural claim about the software, and it is accurate. It is not the same as holding a certification, and we will not blur the two.
| Framework | Status | What that means |
|---|---|---|
| HIPAA / HITECH | Engineered to | Security Rule safeguards implemented in product; BAA available. HIPAA has no certifying body — any vendor claiming to be "HIPAA certified" is misusing the term. |
| GDPR | Engineered to | Article 28 processor terms in the DPA; SCCs incorporated; data subject rights supported in-product. |
| India DPDP Act 2023 | Engineered to | Data Processor obligations in the DPA; grievance contact published. Formal officer designation tracks the DPDP Board notification timeline. |
| NABH | Aligned | Quality-measure and infection-control reporting built to NABH expectations. Accreditation is awarded to hospitals, not software. |
| JCI | Aligned | Documentation and audit patterns designed to support JCI surveys. As with NABH, accreditation attaches to the provider. |
| SOC 2 Type II | Not yet | Not currently audited. Relevant primarily to Healthplex-operated deployments; scoping in progress. We will publish the report date when there is one. |
| ISO/IEC 27001 | Not yet | Not currently certified. Controls are built along ISO 27001 lines; formal certification has not been undertaken. |
| HITRUST CSF | Not pursued | No current plan. Raise it with us if your procurement process requires it and we will tell you honestly where we stand. |
| WCAG 2.2 AA | Enforced | Accessibility is a merge requirement, with automated auditing on every shipped screen. |
AI governance
Local models by default, redaction on outbound prompts, every call logged, and clinical output labelled advisory.
- On-premises by default. The default model runs inside your deployment. No prompt, and no patient data, leaves your network unless you deliberately configure a cloud provider.
- Bring your own key. If you do choose a cloud provider, the key is yours and is stored with envelope encryption. That provider becomes a subprocessor only because you enabled it.
- Redaction before transmission. Identifiers are stripped from outbound prompts unless you have explicitly instructed otherwise in writing.
- Every call is auditable. Prompt, response, model, cost, latency, user and tenant are recorded for each invocation.
- Advisory, never authoritative. Clinical decision support output is labelled as advisory in the interface and is not a substitute for clinician judgment. Structured-output validation and citation requirements act as hallucination guards.
- Your data does not train our models. We do not use customer data to train, fine-tune or evaluate models, absent separate written instruction from you.
Subprocessors
In a self-hosted deployment, no subprocessor touches your patient data — because your patient data never reaches us.
This section is Annex III to the Data Processing Addendum and the authoritative list referenced by Section 13 of the Terms of Service. We give at least 30 days' notice before engaging a new subprocessor that would process customer data, and you may object on reasonable data protection grounds.
Processing patient data
| Subprocessor | Purpose | Applies to |
|---|---|---|
| None | No third party processes patient data in a self-hosted deployment. The data resides on your infrastructure and never transits Healthplex systems. | Self-hosted deployments — the default model |
Where an organisation contracts for a Healthplex-operated deployment, the infrastructure and communications subprocessors for that specific environment are named in the applicable Order and notified before the environment is provisioned. We do not maintain a speculative list here for a model most customers do not use.
Optional AI providers — engaged only if you enable them
| Provider | Service | Region | Engaged by default |
|---|---|---|---|
| Ollama (local) | On-premises model inference — the platform default | Inside your deployment | Yes — and it is not a subprocessor, because nothing leaves your network |
| Anthropic | Cloud model inference via BYOK gateway | US | No — opt-in |
| OpenAI | Cloud model inference via BYOK gateway | US | No — opt-in |
| Cloud model inference via BYOK gateway | US | No — opt-in |
This website and our sales process
| Category | Purpose | Data processed | Region |
|---|---|---|---|
| Website hosting | Serving healthplex.app; server logs | IP address, user agent, pages requested | US / EU |
| Email delivery | Replying to enquiries | Name, work email, message content | US |
| Sales CRM | Pipeline management | Name, work email, organisation | US |
These handle enquiry data only — never patient data. See the Privacy Policy for detail. To subscribe to change notifications, email privacy@healthplex.app with the subject "Subscribe: subprocessor notifications".
Responsible disclosure
Report a vulnerability to security@healthplex.app. We acknowledge within two business days and will not pursue good-faith researchers.
If you believe you have found a security vulnerability in Healthplex, tell us before you tell anyone else. Email security@healthplex.app with enough detail to reproduce the issue.
| Stage | Our commitment |
|---|---|
| Acknowledgement | Within 2 business days |
| Initial assessment | Within 5 business days, including severity and expected timeline |
| Fix for critical issues | Target 14 days, with an interim mitigation published sooner where one exists |
| Customer notification | Affected customers notified with remediation guidance before public disclosure |
| Credit | Public credit where you want it; anonymity where you prefer |
Safe harbour. We will not pursue legal action against researchers who act in good faith: test only against your own deployment or an environment we have authorised, avoid privacy violations and service degradation, do not access or retain patient data, and give us reasonable time to remediate before disclosing publicly.
Please do not test against another organisation's production deployment. Because Healthplex is self-hosted, any live instance you find on the internet belongs to a hospital — not to us — and probing it is unauthorised access to their systems.
Legal documents
The contractual layer underneath everything on this page.
Terms of Service
The commercial agreement — licence grant, deployment models, liability, termination.
Privacy Policy
What we do with enquiry data from this website and the sales process.
Data Processing Addendum
GDPR Article 28 terms, HIPAA Business Associate provisions, DPDP obligations, SCCs and the full control annex.
Security questionnaires
Sending a CAIQ, SIG or your own vendor assessment is fine — email security@healthplex.app and we will complete it.
Talk to a human
If something here does not answer your question, ask us directly.
Security architecture and vulnerability reports: security@healthplex.app
Privacy, DPA and data subject requests: privacy@healthplex.app
Contracts and legal: legal@healthplex.app
We would rather have a specific conversation about your threat model than send you a badge wall.
Last reviewed 5 July 2026 — Healthplex, Inc.