Protect data
Encryption, data-use governance, retention configuration, and secure integration patterns support sensitive workflows.
Trust · Security & privacy
Protecting every care conversation.
Security, privacy, access controls, clinical governance, and auditability are designed into the Avery platform.
Access & responsibilityIllustrative preview
Workspaces1 / 3
Organize the work around your organization.
Manage workspaces and suborganizations, with their own Caregivers, patients, members, and connections.
- Workspace
- Care operations
- Organization
- Regional clinic
- Programs
- Assigned Caregivers
Clear organizational structure
Explore the steps · For demonstration only, no live actions
A compliance program you can review.
Security, privacy, access controls, clinical governance, and auditability are designed into the Avery platform.
SOC 2
Security assurance
Request the SOC 2 report and confirm the systems, controls, and review period relevant to your deployment.
ISO/IEC 27001 Certified
Information security management
Certification for information security management. Request the certificate to review the certified entity and scope.
ISO/IEC 42001 Certified
AI management
Certification for AI management. Request the certificate to review the certified entity and scope; this is not a clinical license.
HIPAA compliance
BAAs available where applicable
DriveHealth supports HIPAA compliance with administrative, technical, and physical safeguards. Business Associate Agreements are available where applicable to the services and relationship.
GDPR compliance
Privacy and data protection
Our privacy program supports applicable GDPR obligations, including lawful processing and individual rights. Review data-processing roles and contractual terms for your use case.
DriveHealth uses Drata to manage its compliance program and share security documentation. Reports and certificates define their own scope; review these alongside your deployment requirements.
How this responsibility is implemented
Control access
Role-based access, least privilege, workspace isolation, and review processes define who can reach what.
Maintain evidence
Audit logging, environment separation, change control, and operational review support accountability.
Security reviews should begin with architecture and evidence.
Keep organizational boundaries explicit.
Healthcare interaction programs require clear separation between workspaces, environments, users, and connected systems. Access should follow defined roles and minimum-necessary principles rather than inheriting broad platform permissions.
- Tenant and workspace isolation
- Role-based access control
- Environment separation
Access & responsibilityIllustrative preview
Workspaces1 / 3
Organize the work around your organization.
Manage workspaces and suborganizations, with their own Caregivers, patients, members, and connections.
- Workspace
- Care operations
- Organization
- Regional clinic
- Programs
- Assigned Caregivers
Clear organizational structure
Explore the steps · For demonstration only, no live actions
Govern data throughout its lifecycle.
Protection extends beyond transport and storage. Retention, approved use, integration paths, backups, secrets, and deletion processes all shape how interaction data is managed in a deployed program.
- Encryption in transit and at rest
- Retention configuration
- Secret and key management
Access & responsibilityIllustrative preview
Workspaces1 / 3
Organize the work around your organization.
Manage workspaces and suborganizations, with their own Caregivers, patients, members, and connections.
- Workspace
- Care operations
- Organization
- Regional clinic
- Programs
- Assigned Caregivers
Clear organizational structure
Explore the steps · For demonstration only, no live actions
Make operational change reviewable.
Security depends on ongoing operating discipline. Audit trails, access review, vendor review, change control, monitoring, and incident procedures provide the evidence needed to evaluate how a system is being managed.
- Audit logging
- Access and vendor review
- Change and incident processes
Access & responsibilityIllustrative preview
Workspaces1 / 3
Organize the work around your organization.
Manage workspaces and suborganizations, with their own Caregivers, patients, members, and connections.
- Workspace
- Care operations
- Organization
- Regional clinic
- Programs
- Assigned Caregivers
Clear organizational structure
Explore the steps · For demonstration only, no live actions
A security model connected to the deployed program.
Qualified organizations can review security, privacy, infrastructure, and governance materials through the enterprise review process.
Access & responsibilityIllustrative preview
Workspaces1 / 3
Organize the work around your organization.
Manage workspaces and suborganizations, with their own Caregivers, patients, members, and connections.
- Workspace
- Care operations
- Organization
- Regional clinic
- Programs
- Assigned Caregivers
Clear organizational structure
Explore the steps · For demonstration only, no live actions
Built for governed healthcare interaction.
Safety
Deterministic boundaries and escalation architecture operate alongside generative conversation.
Explore SafetySecurity
Controls and infrastructure are designed around approved access, handling, and operational requirements.
Explore SecurityVisibility
Structured outcomes help teams understand what occurred and what action followed.
Explore VisibilityQuestions about security & privacy
Can organizations request security documentation?
DriveHealth uses Drata to manage its compliance program and share security documentation. Contact our team to request relevant reports, certificates, and deployment-specific security documentation.
Are Business Associate Agreements available?
DriveHealth supports HIPAA compliance with administrative, technical, and physical safeguards. Business Associate Agreements are available where applicable to the services and relationship.
Does access support organizational roles?
The platform is designed around role-based access, least-privilege practices, workspace boundaries, and access review.
How are integrations considered?
Connected systems should use approved, secure integration patterns with defined access, data flow, and operational ownership.
Review security in the context of your program.
Talk with Drive Health about architecture, controls, and the enterprise review process.