FAQ for Upvio's Transparency and Control

Here are some of the frequently asked questions on Upvio's security, transparency and control.

Transparency and Control:

Patients retain rights to access, rectify, or erase their data. We provide clear documentation on data-handling practices and respond to requests within GDPR timelines.  

Notification:

Any changes to data processing (e.g., new sub-processors) are communicated in advance, per contractual commitments. 

Are standard GDPR protections in place for this?:
Upvio adheres to GDPR standards for EU/Irish customers through SCCs and the EU-U.S. DPF for lawful cross-border data transfers, AES-256/TLS encryption, 72-hour breach alerts, and tools for patient data access/erasure (excluding archived clinical records).

Do you use any third-party companies (sub-processors) to help run your service or store data? - If so, can we get a list of them, and will we be told if any new ones are added?:
We are in the process of compiling the full list as part of our compliance work, transferring all security data into a dedicated security platform. Our new SOC2/ISO 27001 certification also forms part of this process. You will be notified of new additions via our Trust Center, and the full list will be available within the next 2 months. 

• • Process:  

• • Compliance:  

• • Customer Action:  
    • Report suspected breaches to Upvio promptly (e.g. support@upvio.com). 
    • Cooperate in investigations as required by Upvio’s terms.  
  • Assurance:

Timely communication is prioritised, with terms likely detailed in Upvio’s DPA or breach policy.

Security Breach Process:

It commences with the detection of potential security issues through our monitoring systems and alerts from various sources. Once identified, our incident response team is promptly notified, initiating an investigation to determine the incident's scope and impact. We then take appropriate actions to mitigate the threat, recover affected systems, and implement preventative measures to avert future incidents. Throughout this process, we maintain clear communication and thorough documentation to ensure transparency and enhance our security practices continuously. Our public status page will always contain updates on our progress across the whole platform. If affected, individual customers will be contacted with the scope of the breach and how their data was affected.
All services are kept updated on https://status.upvio.com/ 

Patient Data Access

Can your system help us respond if a patient asks to see, update, or delete their data?
Do you help with that or would it all be on us?
Yes, Upvio’s system supports GDPR-compliant responses to patient requests:  

Access/Updates:  
Patients can securely view or request edits to their data.  
Audit logs track all changes for compliance.  

Deletions:  
Non-Archived Data: Removable upon validated requests.  
Archived Data: Critical records (e.g medical history) are preserved for legal/clinical obligations and cannot be deleted.  

Your Role:  
Verify patient identity and authority.  

Assess legal exceptions (e.g privacy risks).  

Our Support:  
Tools for secure access, edits, and deletion of non-archived data.  
Guidance on workflows (legal decisions remain your responsibility).

• Incident Response:  

• Liability Caps:  

• Indemnification:  

• Insurance Backing:  

• Shared Responsibilities:  

Irish Law Compliance

1. GDPR: Adheres to Articles 6/9 for lawful health data processing and cross-border transfers via SCCs.  
2. EHDS Alignment: Supports interoperability (HL7/FHIR) and secure data exchange to meet future EU Health Data Space requirements.  
3. Security Commitments:  

• Irish Health Data: Archive systems ensure clinical/legal data retention compatible with Ireland’s Health Information Bill principles.  

Focus on GDPR

• Data Processing Addendum (DPA):  

• Data Protection by Design:  

• Patient Rights:  

• Transparency & Accountability:  

• Certifications in Progress: