Loading...
Loading...
Regenemm builds with privacy-first defaults, least-privilege access, encryption posture, and auditable workflow principles. Security and governance are architectural, not add-ons.
Patient-identifiable content belongs only in approved clinical storage, clinician UI, approved exports, and consented sharing flows. It is not a telemetry, analytics, URL, metric-label, or marketing-data input.
Material clinical outputs remain draft until reviewed through the appropriate clinical workflow. AI can assist with drafting, retrieval, summarisation, and verification, but clinical responsibility remains with authorised humans.
Hub APIs are tenant-scoped, spoke-identified, and request-correlated. Spokes are bounded workflow surfaces; durable clinical state and audit records return to the Hub.
Governed actions are designed to leave an audit trail with source references, actor context, request identifiers, state transitions, and release history rather than relying on operational logs as clinical evidence.
Outbound sharing is scoped by purpose, recipient, authority, expiry, and patient control where appropriate. Release pathways are designed to be explicit rather than improvised.
Security and clinical governance updates are described publicly at a safe level. Detailed release evidence, infrastructure topology, exploit mechanics, and clinical safety sign-off remain internal.
Use encryption in transit and at rest, tenant boundaries, least-privilege access, and region-aware hosting posture.
If consent, identity, audit, release, or verification controls cannot be satisfied, the governed action should not proceed silently.
Record operational metadata, request IDs, state changes, and decision context without placing PHI into logs, traces, URLs, or metrics labels.
Patient-facing, external, billing, medicolegal, and clinically relied-upon outputs require appropriate review and release gates.
Regenemm has been building toward formal certifications since November 2024. ISO 27001, SOC 2, HIPAA compliance, GDPR alignment, and ISO 42001 audits are entering final stages. Formal attestations and certifications will be published as audits complete.
We do not claim certified status until audits are complete. Current posture reflects readiness work in progress.
For security reviews or audit documentation requests, contact security@regenemm.com