Security and privacy
Where patient data lives, how it is protected, what we log, and the standards Relaya meets: NABH Compliant, ABDM-Ready, DPDP Compliant.
Before you decide
NABH Compliant, ABDM-Ready, DPDP Compliant, ISO 27001 Aligned, HIPAA Ready and GDPR Compliant.
Patient data is hosted in India.
A list of the service providers that process data for us is available on request.
Relaya is DPDP Compliant, NABH Compliant and ABDM-Ready. It includes consent records, and patient data export and erasure tools.
Card and UPI payments are processed by Razorpay. Card security standards (PCI-DSS) are Razorpay's.
ISO 27001 Aligned: information security management following ISO 27001 principles. Certification in progress.
HIPAA Ready: technical safeguards meeting US healthcare data protection requirements. BAA available for cross-border partnerships and NRI clinics.
GDPR Compliant: patient data of clinics in the UK and Europe is processed under the GDPR, with a data processing agreement and patient data export and erasure.
Our Data Processing Agreement sets out how we process patient data for your clinic. A list of the service providers that process data for us is available on request.
Write to security@relaya.one. Tell us what you found and how to reproduce it. We will reply and keep you informed.