How we protect your health data
This document is maintained by Preventa Health to answer common security and privacy questions about the Preventa Health platform. It is editable content, not a substitute for an independent certification statement. Every control and figure on this page is drawn from the same source that generates our downloadable Security & Data Protection Summary.
Last reviewed: July 2026
Current external scan status
Independently scanned by Aikido Security — current posture rating: Excellent, with 2 low-severity findings open and no medium, high or critical findings.
Last external scan: July 2026. Continuous scanning covers application code, dependencies, cloud configuration, secrets and public surface. Aikido is an independent third-party security platform; this is not a formal certification.
Latest penetration test — Aikido, 04 July 2026
- Type:
- White-box web application test
- Overall risk posture:
- A — Excellent
- Scope:
- preventa-health.com, www.preventa-health.com, preventa-health.lovable.app and backend API
- Open findings:
- 0 critical · 0 high · 0 medium · 2 low
- Avg. remediation time:
- 1.4 hours
- Methodology:
- OWASP Top 10, OWASP ASVS, PTES, NIST SP 800-115, OWASP AI Testing Guide (incl. agentic behaviour)
Attestation letter and full penetration test report available on request under NDA. Aikido is an independent third-party security platform; this is not a formal certification.
Active security controls
Encryption in transit & at rest
TLS 1.3 for all client and service-to-service traffic. AES-256 for data at rest in primary database, backups, file storage and the report cache.
Invite-only email OTP sign-in
Sign-in is invite-only. Users receive a 6-digit one-time code by email — there are no passwords and no public sign-up. Rate limits (5 codes/email/hour, 20/IP/hour) and a 5-attempt lockout protect against brute force. Six-role RBAC is enforced by row-level security in the database and re-validated in every privileged edge function.
Independent penetration testing
White-box web application penetration test conducted by Aikido on 04 July 2026, covering the marketing site, app and backend API. Methodology aligned with OWASP Testing Guide v4.2, OWASP ASVS, PTES, NIST SP 800-115 and the OWASP AI Testing Guide (including agentic behaviour).
EU-only data residency
Production database, object storage and edge functions run inside the European Union. No personal data is replicated outside the EU.
Row-level security
Row-level security policies on every public table isolate data at the database level so users can only reach records their role is authorised to see.
Role-based access control
Six roles (Employee, Employer, Nurse, Doctor, Admin, Department Manager) enforced via security-definer database functions and re-validated in every privileged edge function.
PII isolation (PID/UTID)
Dual-identity architecture separates personal identifiers (PID) from clinical results (UTID). Employer-role queries cannot reach the persons table.
Audit logging & monitoring
Append-only audit_logs and clinical_notes_history tables capture privileged actions. Compliance logs retain scanner output and dependency-scan history.
Change management
All schema and code changes flow through reviewed migrations and pull requests. Automated dependency scanning runs against each release.
Supplier management
Sub-processors are documented and reviewed at least annually. See the sub-processor register for the current list.
Staff MFA
Multi-factor authentication is required for all internal administrator, clinician and operator accounts that can access production data.
Cryptographic key management
Encryption keys are managed by the hosting provider's managed KMS. Application code never handles raw key material; tokens and secrets are stored in the secrets vault.
Backups & restore testing
Daily encrypted backups with point-in-time recovery. Tabletop restore exercises quarterly; full restore drill at least annually.
Vulnerability management SLA
Critical fixes shipped within 7 days, High within 30 days, Medium within 90 days from confirmed triage. Dependency scanner runs on every release.
Logging & retention
Audit and access logs retained for 12 months. Clinical biomarker data is retained for 2 years (GDPR-aligned retention) and then cascade-deleted.
Secure development (SDLC)
Mandatory peer review for all changes, automated dependency and secrets scanning, and migration-based schema changes with rollback path.
Shared report security
Time-limited tokens, bcrypt (work factor 12) password hashing, and maximum-access-count limits protect any report shared outside the platform.
Minimum cohort size
Employer aggregate reports require a minimum participant count (default 5) to prevent individual identification.
Governance documents
Plain-language policies that describe how Preventa Health is operated. Each document is maintained by Preventa Health and reviewed at least annually.
Information security policy
Scope, roles, asset & access management, cryptography, supplier and incident management.
Incident response plan
Detection through post-mortem, with our GDPR Art. 33 72-hour notification commitment.
Risk management
Methodology, top-level risk categories and current mitigations under quarterly review.
Control framework (GDPR Art. 32 aligned)
Our technical and organisational measures are organised around the confidentiality, integrity, availability and verification themes of GDPR Article 32.
Confidentiality (Art. 32(1)(b))
- TLS 1.3 in transit, AES-256 at rest
- Row-level security on every public table
- RBAC with least-privilege role separation
Integrity (Art. 32(1)(b))
- Append-only audit log of privileged actions
- Migration-controlled schema changes
- Clinical notes captured in immutable history table
Availability & resilience (Art. 32(1)(b))
- Daily encrypted backups with point-in-time recovery
- EU-hosted infrastructure with provider-managed redundancy
- Quarterly restore tabletop, annual full restore drill
Tested, assessed and evaluated (Art. 32(1)(d))
- Continuous dependency and secrets scanning
- Independent penetration testing by Aikido (July 2026)
- Quarterly risk-register review
- Annual review of this posture page and supporting policies
Responsible disclosure
If you believe you have found a security vulnerability in any Preventa Health product, please report it privately so we can investigate and remediate before the issue becomes public.
Contact
security@preventa-health.comMachine-readable policy
/.well-known/security.txtWhat to include
- •A description of the issue and the URL or component affected.
- •Reproduction steps or a proof of concept.
- •The impact you believe it could have.
Our commitment
- •Acknowledge receipt within 3 business days.
- •Provide a triage decision within 10 business days.
- •Keep you informed of remediation progress.
- •Credit researchers on request (see acknowledgments).
Acknowledgments
We thank the security researchers who have helped us improve. Names are listed here with the researcher's consent.