Compliance & Regulatory
GDPR, Valvira, and Finnish healthcare regulation compliance status
GDPR Compliance (EU 2016/679)
7/8 Compliant
Privacy by Design
Compliant
Data minimization and purpose limitation enforced across all entities
Explicit Consent Collection
Compliant
Patient consent tracked with versioning, timestamps, and withdrawal capability
Data Encryption
Configured
AES-256 at rest, TLS 1.3 in transit — configurable at infrastructure level
EU Data Residency
Compliant
All data stored within EU cloud regions (EU-North-1)
Data Retention Policy
Compliant
Medical records retained minimum 12 years per Finnish law (785/1992)
Right to Erasure
Compliant
Data deletion request workflow with legal retention exceptions
Data Portability
Compliant
GDPR export functionality for patient data in machine-readable format
Audit Trail
Compliant
Immutable logging of all data access, modifications, and system events
