Encryption
Data is encrypted in transit using current transport security standards and encrypted at rest in our managed cloud environment.
Security & compliance
Designed around protected health information.
Clinical communication only works if the people responsible for governance can defend it. This page sets out how Helix Health handles protected health information (PHI), who can reach it, and what we expect from your facility in return.
Controls
What protects your data
Technical, administrative, and physical safeguards, reviewed together with your team before go-live.
Identity and access
Every account is tied to a verified individual with a defined role. Access follows least privilege, and leavers are removed centrally the moment they are offboarded.
Audit trails
Message delivery, acknowledgement, escalation, and administrative changes are recorded so an incident review can reconstruct what happened.
Device safeguards
Session controls, remote sign-out, and configurable behaviour for shared ward devices, so a shared handset does not become a data leak.
Data lifecycle
Retention periods, export formats, and deletion timelines are agreed with your records policy rather than assumed by us.
Availability
Redundant infrastructure, monitoring, and backup procedures, with service commitments written into your agreement rather than left implied.
Shared responsibility
Who is responsible for what
Security in a hospital is never one party's job alone. We are explicit about the split so nothing falls into a gap between us.
| Area | Helix Health | Your facility |
|---|---|---|
| Platform security | Infrastructure, encryption, patching | Review during procurement |
| User accounts | Tooling and role model | Who gets an account, and when it ends |
| Clinical content | Platform and versioning | Approving your own protocols |
| Device management | App-level controls | Device policy and physical security |
| Staff behaviour | Training material | Policy, supervision, enforcement |
For your procurement pack
On request, we provide the documentation your governance and IT teams need to complete an assessment:
- Security overview and architecture summary
- Data flow description, including where data is stored
- Business associate agreement (BAA) where applicable
- Incident notification process and contact path
- Retention, export, and deletion commitments
- Subprocessor list for services we rely on
Standards we build to
Helix Health is built to HIPAA safeguards for protected health information and to Ghana's Data Protection Act, administered by the Data Protection Commission.
Common questions
What governance teams ask first
Is Helix Health HIPAA compliant?
Compliance is a property of how a system is deployed and operated, not a badge a product carries on its own. Helix Health is built around HIPAA's safeguards — encryption, access control, auditability, and a business associate agreement where applicable — and we work through your specific obligations with you during procurement.
Where is our data hosted?
In a managed cloud environment with encryption at rest. If your facility has data residency requirements, raise them early — hosting region is part of the commercial discussion and we will tell you plainly what is possible.
Can Helix Health staff read our messages?
Administrative access to production systems is restricted to a small number of authorised engineers, requires justification, and is logged. It is used for support and incident response, not routine work. The controls governing this are described in the documentation we provide for your review.
What happens if there is a breach?
We maintain an incident response process covering containment, investigation, and notification. Notification timelines and contact points are set out in your agreement so your team knows exactly who will call, and how quickly.
Can we export or delete our data?
Yes. Export formats and deletion timelines are agreed in the subscription agreement. Your data remains yours throughout, and the exit process is documented before you sign rather than negotiated afterwards.
Bring your security team to the demo.
We would rather answer the hard questions early than after a contract is signed.