Security and privacy are the product, not a feature
XyberHealth handles some of the most sensitive data a person has — health goals, biomarkers, medications, cycle data. We engineer to recognized security standards and build to the privacy laws of every region we serve. Here is exactly how, in plain language.
How we protect your data
Row-Level Security on every table
Postgres RLS enforces, at the database, that you can only ever read or write your own rows — verified by automated advisors, not just app code.
Encryption in transit & at rest
TLS everywhere, encryption at rest on the database, and AES-256-GCM application-layer encryption for private messages.
Modern, local-verify auth
Asymmetric (ES256) JWTs verified locally, server-side session checks, and TOTP multi-factor authentication support.
Consent-gated health data
Health and health-adjacent data can only be written with a recorded, active consent — enforced both in the app and as a database check.
We never train AI on your data
Your profile is never sent to a model for training. AI features run on a closed, cited corpus and tell you when you're talking to AI.
Least privilege & secret hygiene
Secrets live in a managed vault (never in the client), service-role access is isolated to trusted server paths, and admin areas are separately gated.
Rate limiting & abuse controls
Expensive and external-facing endpoints are rate-limited per client before any costly work runs, with payload-size caps.
Data minimization by default
Queries fetch only the columns they need, secret columns never leave the database, and personal data is never placed in logs or URLs.
Security standards we engineer to
Our controls are designed around the principles of these standards.
OWASP Application Security Verification Standard + Top 10
alignedOur application controls (authn/z, input validation, output encoding, RLS) are engineered to the OWASP ASVS and defend against the OWASP Top 10.
NIST Cybersecurity Framework 2.0
alignedOur security program is organized around the NIST CSF functions: Govern, Identify, Protect, Detect, Respond, Recover.
AICPA SOC 2 (Trust Services Criteria)
third-party certifiedEngineered to the SOC 2 Trust Services Criteria (security, availability, confidentiality). Key subprocessors maintain their own SOC 2 Type II reports, which we hold on file.
ISO/IEC 27001 Information Security Management
alignedOur information-security management practices are designed around the ISO/IEC 27001 control set.
CIS Critical Security Controls
alignedInfrastructure and account hardening follow the CIS Critical Security Controls.
Payment Card Industry Data Security Standard
third-party certifiedWe never touch raw card data — payments run through a PCI-DSS Level 1 processor (Stripe), keeping us to SAQ-A scope.
Privacy & data-protection law we build to comply with
Scoped honestly by region and by how you use the platform.
EU General Data Protection Regulation (2016/679) + UK GDPR
Built to comply with the GDPR / UK GDPR — lawful basis, explicit consent for health data, and data-subject rights.
Canada PIPEDA + provincial health-privacy law (e.g. Ontario PHIPA)
Built to comply with Canadian privacy law (PIPEDA and provincial health-privacy regimes such as PHIPA).
US Health Insurance Portability and Accountability Act
Where we operate the B2B2C clinic path, we build to HIPAA and execute Business Associate Agreements. The direct-to-consumer wellness app is not a HIPAA covered entity.
FTC Health Breach Notification Rule + Washington My Health My Data Act + FTC §5
Our US direct-to-consumer service is built to the FTC Health Breach Notification Rule, WA MHMDA, and FTC §5 honest-claims standard.
UAE Federal Decree-Law 45/2021 + ICT Health Law
For the UAE, we build to the PDPL and ICT Health Law, including in-region data-residency requirements before launch there.
Saudi Personal Data Protection Law (SDAIA) + NCA ECC
For Saudi Arabia, we build to the SDAIA PDPL and NCA Essential Cybersecurity Controls, including in-Kingdom hosting for health data.
Qatar Personal Data Privacy Protection Law (Law 13/2016) + NCSA
For Qatar, we build to the PDPPL and NCSA National Information Assurance standards.
EU AI Act (Regulation 2024/1689)
Our AI features meet the EU AI Act limited-risk transparency duties: you are told when you're talking to AI, outputs are grounded and non-diagnostic, and we never train on your data.
Data residency & privacy by design
We design for regional data residency where the law requires it (for example, in-region hosting for GCC health data) and default to data minimization, owner-only access, and private-by-default storage.
Responsible disclosure
Found a vulnerability? We want to hear from you. Email security@xyber.health and we'll work with you in good faith. Please don't access other people's data while testing.
An honest note on what these claims mean
These describe the standards and regulations our security and privacy programs are designed around and built to comply with. Except where we explicitly state a third-party certification, alignment with a framework is not itself a claim of certification or accreditation. Coverage varies by region and by whether you use the direct-to-consumer app or the clinic path.
Questions about privacy or your data? See our Privacy policy or our Legal center, or email privacy@xyber.health.