24/7 Monitoring
Continuous security monitoring and alerting across all production systems.
Trust Center
Privacy, Security & Compliance
EPISOFT operates a healthcare-grade & Software-as-a-Service platform engineered for compliance with GDPR, UK GDPR, HIPAA, SOC 2, and ISO/IEC 27001. We support independent clinics, multi-location providers, enterprise healthcare organizations, and regulated medical service operators.
- Data Controller / Processor roles clearly defined
- Signed BAAs and DPAs available on request
- Independent SOC 2 and ISO/IEC 27001 audits
- Effective
- 2026
- Frameworks
- 5+
- Review Cycle
- Annual
HIPAA
GDPR
SOC 2 · ISO
Privacy Policy
Customers act as Data Controllers. EPISOFT acts as a Data Processor under GDPR and a Business Associate under HIPAA. Personal data and Protected Health Information are processed solely to provide contracted services.
Data Controller
Customer / Clinic
Data Processor
EPISOFT
Business Associate
EPISOFT (HIPAA)
HIPAA Business Associate Agreement
Executed electronically. Signed BAAs are available on request.
1. Definitions (HIPAA)
- Covered Entity — 45 CFR §160.103
- Business Associate — EPISOFT, 45 CFR §160.103
- Protected Health Information (PHI) — 45 CFR §160.103
- Security Incident — 45 CFR §164.304
- Breach — 45 CFR §164.402
2. Permitted Uses and Disclosures
- Provision of SaaS services under the master services agreement
- System administration, maintenance, and security operations
- Compliance with applicable law and regulatory obligations
PHI is never used for advertising, marketing, profiling, or unrelated analytics.
3. Safeguards
- Administrative, technical, and physical safeguards per 45 CFR §164
- Encryption of PHI at rest and in transit
- Role-based access controls and least-privilege enforcement
- Comprehensive audit logging and monitoring
4. Breach Notification
EPISOFT shall notify the Covered Entity without unreasonable delay and no later than 60 days following discovery of a Breach.
5. Subcontractors
All subcontractors with access to PHI are subject to written agreements imposing HIPAA-equivalent obligations.
6. Termination
Upon termination, PHI shall be returned or securely destroyed. If destruction is infeasible, protections shall survive indefinitely.
GDPR Data Processing Agreement
Signed GDPR Data Processing Agreements are available on request.
1. Definitions (GDPR)
- Personal Data — Article 4(1)
- Processing — Article 4(2)
- Controller — Article 4(7)
- Processor — Article 4(8)
- Special Categories — Article 9
2. Roles
- Controller: Healthcare Provider
- Processor: EPISOFT
3. Subject Matter and Purpose
Processing of healthcare, administrative, and operational data to provide clinic management SaaS services.
4. Processor Obligations
- Process data only on documented instructions (Article 28)
- Maintain confidentiality commitments
- Implement technical and organizational measures (Article 32)
- Assist with data subject rights requests
- Notify personal data breaches within 72 hours
5. International Transfers
Cross-border transfers are safeguarded using Standard Contractual Clauses (SCCs) and UK International Data Transfer Agreements (IDTA), where applicable.
Incident Response and Breach Handling
Escalation Procedures
Incident classification and tiered escalation paths for every severity level.
Customer Notification
Structured notification workflows per contractual and regulatory timelines.
Post-Incident Review
Root cause analysis and remediation tracking through closure.
Availability and Service Level Commitments
99.9% Uptime Target
Contractual SLA backed by redundant cloud infrastructure.
Redundant Infrastructure
Multi-zone deployment with automatic failover.
Daily Encrypted Backups
Point-in-time recovery with 30-day retention.
DR and Continuity Testing
Regular disaster recovery drills and business continuity validation.
Sub-Processors
All sub-processors are vetted and contractually bound to equivalent data protection, confidentiality, and security obligations.
| Category | Purpose | Region |
|---|---|---|
| Cloud Infrastructure | Hosting and data storage | EU / US |
| Email Delivery | Transactional communications | Global |
| Monitoring and Logging | Security and reliability | EU / US |
Regulatory Mapping
| Framework | Coverage |
|---|---|
| HIPAA | Privacy Rule, Security Rule, Breach Notification Rule |
| GDPR | Articles 5, 6, 9, 28, 32, 33 |
| SOC 2 | Security, Availability, Confidentiality |
| ISO 27001 | Risk, Access Control, Incident Management, Continuity |
Document Governance
Version 1.0
Current revision of the Trust Center documentation set.
Effective Jan 1, 2026
Applies to all active customers and new engagements.
Annual Review
Material changes are communicated contractually and via the platform.
Country & Jurisdiction-Specific Annexes
Jurisdiction-specific data protection and compliance annexes support local regulatory requirements and supervisory authority expectations.
-
European Union (EU) Country-specific GDPR annexes (Germany, France, Netherlands), including local supervisory authority references and health data nuances.
-
United Kingdom (UK) UK GDPR annex incorporating the Data Protection Act 2018 and UK International Data Transfer Agreement (IDTA).
-
United States (US) HIPAA-focused annexes aligned with federal requirements and applicable state-level healthcare privacy laws.
-
Other Jurisdictions Annexes for Canada (PIPEDA), Australia (Privacy Act), and other regions available on request.
Control-to-Regulation Mapping
Formal mapping that links internal controls to regulatory frameworks. Available under NDA.
| Framework | Mapped Controls | Purpose |
|---|---|---|
| HIPAA | Administrative, Technical, Physical Safeguards | Healthcare privacy and security compliance |
| GDPR / UK GDPR | Articles 5, 6, 9, 28, 30, 32, 33 | Lawful processing and data protection |
| SOC 2 | CC Series Controls | Security, availability, confidentiality assurance |
| ISO/IEC 27001 | Annex A Controls | Information Security Management System |
SOC 2 Reports & Audit Evidence
Independent third-party audits validate the effectiveness of our controls. Reports available under NDA.
SOC 2 Type I
Design of controls
SOC 2 Type II
Operating effectiveness
Security
Control coverage
Availability
Uptime assurance
Confidentiality
Data protection
Trust Center Portal
Centralized access to compliance documentation
A dual-layer Trust Center provides high-level transparency for prospects and detailed, signed, and timestamped artifacts for customers under NDA.
-
Public Trust Center High-level overview, SOC 2 summary, privacy policies, and certifications.
-
Private Trust Center Customer-specific artifacts, signed agreements, audit reports, sub-processor details.
-
Signed Artifact Downloads Cryptographically verified, tamper-evident PDFs for regulatory defensibility.
Procurement & Due Diligence Support
Dedicated compliance and security contacts support enterprise and regulated customers throughout vendor risk assessment.
Security Questionnaires
SIG, CAIQ, and custom questionnaire support.
DPIA Support
Data Protection Impact Assessment assistance.
Vendor Risk Reviews
Support through third-party risk assessment processes.
Regulatory Inquiry Support
Coordination for audits and regulatory reviews.
Change Logs
Timestamped history for all compliance artifacts.
Real-Time Notifications
Sub-processor changes communicated contractually.
Need a signed BAA, DPA, or audit report?
Our compliance team works directly with your legal, procurement, and security teams. Reach out and we'll route your request to the right person within one business day.