Information about our compliance standards, certifications, controls, and data protection practices
Elderwise is committed to achieving and maintaining compliance with key industry certifications. Our strategic roadmap outlines our journey toward full certification, with timelines tailored to the complexity and requirements of each standard.
Elderwise follows a structured approach to compliance certifications with timelines tailored to each standard's complexity. We prioritize certifications based on market requirements and technical complexity, with our most comprehensive certifications (HITRUST) targeted for Q3 2026, while more focused certifications like ISO 27001 are targeted for completion by Q1 2026.
Creation of policies, procedures, and controls documentation
Assessment of current practices against certification requirements
Deploying necessary controls and remediation activities
Verification of control effectiveness before external assessment
Official certification audit by accredited third parties
Receipt of formal certification and continuous monitoring
While formal certifications are in progress, Elderwise has already implemented key security and privacy controls aligned with healthcare standards. Our approach follows industry-standard continuous compliance methodology, emphasizing automated evidence collection, regular assessments, and security by design.
We provide interim compliance documentation to customers, including security questionnaire responses, SOC 2 readiness assessments, and draft BAAs/DPAs while formal certification is underway.
Following compliance best practices, Elderwise employs continuous monitoring tools to automatically detect and remediate compliance drift, ensuring our systems maintain compliance between formal assessment periods.
U.S. santé privacy and security law governing PHI.
U.S. santé privacy and security requirements governing PHI handling by covered entities and business associates.
BAAs in place with processors, enforced RBAC/MFA/SSO, centralized audit logs, least-privilege defaults, AES-256/TLS 1.3 encryption, incident response runbooks, and recurring HIPAA training.
EU data protection regulation covering lawful processing and rights.
EU/EEA framework for data protection, lawful processing, and data subject rights.
Consent capture and audit trails, DPA addenda with vendors, privacy by design reviews, DSR workflows, and transfer impact évaluations where applicable.
Singapore data protection law emphasizing consent and purpose limitation.
Singapore data protection obligations for consent, purpose limitation, notification, and access/correction.
Localized consent statements, retention schedules, access/correction channels, and breach notification procedures aligned with PDPC guidance.
International ISMS standard for managing information security risques.
International standard for establishing, implementing, maintaining, and continuously improving an ISMS.
Formal ISMS scope definition, risque register, policies and control mapping, internal audits, and readiness for certification.
Attestation of security controls effectiveness over a period (Type II).
Attestation of control effectiveness over a review period per AICPA Trust Services Criteria.
Control mapping to TSC, evidence collection automation, continuous surveillance, quarterly control testing, and external audit readiness.
Santé-centric certifiable security framework harmonizing multiple standards.
Santé-focused certifiable framework harmonizing HIPAA, ISO, NIST, and other requirements.
Scope definition for PHI systems, control inheritance where applicable, and staged readiness toward validated évaluation.
Singapore HSA guidance for médical technologies and software.
Regulatory guidance for médical device software and santé tech solutions in Singapore.
Alignment with HSA advisories, documentation of intended use and risque controls; leverage ISO 14971/IEC 62304 where applicable.
U.S. breach notification and enforcement enhancements to HIPAA.
U.S. breach notification and enforcement enhancements to HIPAA.
Incident response runbooks, evidence preservation, decision trees for materiality and reporting timelines.
Modern interoperability standard for structured clinique data exchange.
Modern santé interoperability standard for structured clinique data exchange.
FHIR-first data modeling for core entities, versioned profiles, and OAuth2/OpenID Connect for secure access.
Santé messaging standards used by EHRs and labs.
Legacy and current santé messaging standards widely used by EHRs and labs.
Adapters for HL7 v2.x integration where required, normalization to internal schemas, and secure transport.
Quality management system standard for médical devices.
Quality management standard for organizations involved in médical device lifecycle.
Progressive QMS adoption for applicable software modules; align with regulatory pathways if device classification applies.
AI management system standard for responsible AI governance.
Framework for governing responsible AI systems across lifecycle.
Map existing controls to AI risques, define KPIs and documentation for transparency, and institute model governance workflows.
Elderwise is committed to maintaining the highest standards of data protection and regulatory compliance in healthcare technology, with a progressive certification roadmap for completion between Q3 2025 and Q4 2026.
Data Protection Officer:dpo@elderwise.ai
EU Representative (Art. 27 GDPR):eu-rep@elderwise.ai
APAC Representative:apac-rep@elderwise.ai
Security Team:security@elderwise.ai
Vulnerability Reporting:security-alerts@elderwise.ai
Elderwise's phased certification timeline:
Elderwise Healthcare Compliance Commitment:
Our compliance strategy follows Vanta's recommended "security by design" principles, embedding healthcare compliance requirements into our development process from inception to deployment. We recognize that healthcare data security directly impacts patient outcomes and provider efficiency, so our approach integrates technical safeguards with clinical workflow considerations to create a secure environment that enhances rather than impedes care delivery. Our compliance program emphasizes both regulatory adherence and the ethical responsibility we have to protect sensitive health information.