Your patient data is safe
Enterprise-grade security built specifically for healthcare. Every layer of our platform is designed to protect sensitive patient information.
PN-EN ISO/IEC 27001:2023-08 Certified
We hold an active PN-EN ISO/IEC 27001:2023-08 certificate (the Polish adoption of ISO/IEC 27001:2022) covering the design, development, maintenance, and delivery of software-as-a-service (SaaS) and related IT services for the Mediflo platform. Our information security management system is audited by an independent certification body. Certificate details (number, certifying body, validity dates) are available on request to verified partners and prospects at kontakt@mediflo.ai.
- Standard:
- PN-EN ISO/IEC 27001:2023-08
Information security management verified by independent audit.
Full GDPR / RODO Compliance
We are fully compliant with the General Data Protection Regulation. This includes signed data processing agreements (DPA), support for the right to erasure, data portability on request, and transparent data processing records.
Your patients' rights are always protected.
Platform Data Stays in the EU
Mediflo platform data — including call recordings, transcripts, patient and clinic staff data — is processed exclusively on servers located within the European Economic Area. This also applies to services delivered by vendors with their legal seat outside the EU; we have contractual guarantees in place ensuring EEA data residency. Platform data is not transferred to third countries, regardless of the vendor's origin.
Complete data sovereignty within the EU.
Zero Data Retention by AI Providers
Conversation data processed by our AI models is never stored or retained by third-party AI providers. Data flows through a secure pipeline: encrypted in transit, processed in memory, and immediately discarded after analysis.
Your data is processed, never stored by third parties.
Data processing agreement and service agreement
We sign a data processing agreement (GDPR) and a service agreement with every clinic. The roles are clear: your clinic is the controller of your patients' data, Mediflo is the processor.
Two agreements, clear roles, nothing left unsaid.
Full Audit Trail
Every data operation in Mediflo is logged with complete traceability. Access logs, modification history, and data export records are maintained for compliance auditing. Generate reports on demand for internal reviews or regulatory inspections.
Complete traceability for every operation.
Security at every layer
From infrastructure to application, every component is built with security as a first principle.
End-to-end encryption
All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Encryption keys are managed through dedicated key management services.
Role-based access control
Granular permissions ensure team members only access the data they need. Every access is logged and auditable.
24/7 security monitoring
Continuous monitoring of infrastructure and application layers with automated alerting for anomalous activity.
Regular security updates
Proactive dependency management and security patching. Vulnerability scans run continuously across all services.
Ready to take the load off your team?
Book a demo, or start a 14-day pilot on your own number — 0 zł, no card. Connecting the number and the HIS usually takes 2–5 business days.
No credit card • No commitments • 7-day support