Enterprise-grade security

Security & Compliance

Protecting sensitive health data is at the core of everything we build. Corsano Coach meets the strictest healthcare and data protection standards.

HIPAA Compliant

GDPR Compliant

CE-MDR Certified

FDA 510(k)

256-bit AES encryption · SOC 2 Type II in progress · Annual penetration testing

Certifications & Compliance

We invest heavily in meeting regulatory requirements so you can focus on your clients.

CE-MDR

Certified

European Medical Device Regulation

Europe

The CardioWatch 287-2 is certified as a Class IIa medical device under EU MDR 2017/745, enabling clinical use across all European markets.

Class IIa medical device classification
Notified body: BSI (0086)
Full technical documentation available
Post-market surveillance system in place

FDA 510(k)

Cleared

US Food & Drug Administration Clearance

United States

Cleared by the FDA for medical use in the United States, demonstrating substantial equivalence to predicate devices for vital sign monitoring.

510(k) clearance number: K221234
Indicated for continuous monitoring
Validated for clinical accuracy
Compliant with FDA quality system regulations

HIPAA

Compliant

Health Insurance Portability and Accountability Act

United States

Our platform implements comprehensive administrative, physical, and technical safeguards required for handling Protected Health Information (PHI).

Business Associate Agreements (BAA) available
Access controls and audit logging
Encrypted data at rest and in transit
Regular security risk assessments

GDPR

Compliant

General Data Protection Regulation

European Union

Full compliance with EU data protection requirements, ensuring your clients maintain control over their personal health data.

Data Processing Agreements (DPA) provided
Right to erasure implementation
Data portability support
EU data residency options available

Need compliance documentation for your organization?

Request documentation package

Security Features

Built with security-first principles to protect your clients' sensitive health data.

End-to-End Encryption

All data is encrypted using AES-256 in transit and at rest. TLS 1.3 protects all API communications.

Secure Infrastructure

Hosted on AWS with SOC 2 certified data centers. Multi-region redundancy ensures 99.9% uptime.

Audit Logging

Comprehensive audit trails track all data access. Logs are immutable and retained for 7 years.

Access Controls

Role-based permissions with MFA support. SSO integration available for enterprise accounts.

Regular Backups

Automated daily backups with point-in-time recovery. Geographic redundancy protects against data loss.

Incident Response

24/7 security monitoring with defined incident response procedures. Breach notification within 72 hours.

Vendor Management

All subprocessors are vetted for security compliance. Regular third-party security assessments.

Data Minimization

We only collect data necessary for the service. Clear data retention and deletion policies.

Data Residency Options

Choose where your data is stored to meet local regulatory requirements.

🇪🇺

European Union

Frankfurt, Germany

🇺🇸

United States

Virginia, USA

🇸🇬

Asia Pacific

Singapore

Annual Penetration Testing

Last audit: November 2024 · Zero critical findings

Request security report

Security FAQ

Common questions about our security and compliance practices.

All data is encrypted using AES-256 encryption both in transit and at rest. API communications use TLS 1.3. Database fields containing PHI are additionally encrypted at the field level. Encryption keys are managed through AWS KMS with automatic rotation.

Have specific security requirements or questions?

Contact our security team →

Ready to get started?

Transform your coaching practice

Join thousands of health coaches using clinical-grade vitals to deliver better outcomes for their clients.

Start Free Trial Talk to Sales

14-day free trial. No credit card required.