Compliance & Security – Brigid

GDPR Ireland Compliance

Our platform is strictly aligned with the Irish Data Protection Act 2018 and the General Data Protection Regulation (GDPR). We facilitate all data subject rights including the right to access (GDPR Art 15), erasure (Art 17), data portability (Art 20), and lodge complaints with the Data Protection Commission at dataprotection.ie.

Granular patient consent management — 7 categories, accept-all or required-only paths

Article 28 Data Processing Agreements with every clinic customer

Records of Processing Activities (ROPA) per Art 30

Breach notification within 72h per Art 33 — see Breach Notification Runbook

Data Residency: Supabase Dublin (EU-West-1)

At MedPro AI, patient data at rest never leaves the European Union. Our primary and backup infrastructure is in Supabase Dublin (EU-West-1), built on AWS EU-West-1.

Primary storage in Dublin, Ireland (EU)

Encrypted backups with point-in-time recovery (35-day window)

Redundant architecture targeting 99.95% uptime

Strict adherence to HSE Information Security Policy

International Transfers (EU–US Data Privacy Framework)

The large majority of processing stays in the EU. Clinical text inference runs on Google Vertex AI inside the EU and does not flow to the US. A few narrow paths reach the United States, each governed by the EU–US Data Privacy Framework adequacy decision and signed sub-DPAs. See our Transfer Impact Assessment for full safeguards.

Clinical text inference (Brigid, clinical notes, document analysis) runs on Google Vertex AI in the EU (Gemini 3.5 Flash) — it does not leave the EEA

Real-time “Live with Brigid” voice uses Google AI Studio (US) under EU-US DPF + SCCs, with per-session explicit consent; EU-only tenants can disable it (fail-closed)

Voice transcription (dictation, push-to-talk & sessions) runs primarily on ElevenLabs Scribe under SCCs + a signed Art. 28 DPA; an optional US medical-dictation model (Google STT, us-central1) is used only with explicit per-practice consent

Google Cloud STT (europe-west4, Netherlands) provides the EU fallback path and is preferred first for telehealth transcription

Patient opt-out of AI features under Me → What Brigid can do switches off the US transfer entirely

Encryption & PHI Security

Protected Health Information (PHI) is protected with enterprise-grade security layers. We use AES-256 encryption at rest and TLS 1.3 for all data in transit.

AES-256 hardware-level disk encryption

Immutable platform & clinical audit logs — retained 8 years (Irish Health Act 2014 §73)

AI-inference technical log — retained for the lifetime of the device plus 10 years (EU MDR technical-documentation requirements)

Mandatory 2FA for all staff accounts; WebAuthn for clinicians

Row-Level Security (RLS) on every PHI table; principle of least privilege

HSE & Irish Healthcare Alignment

Designed for the Irish healthcare landscape. Our system architecture is designed to align with HSE systems, the HSE Personal Information Disclosure Standard, PCRS billing protocols, and the Irish Medical Council (IMC) regulatory framework.

Aligned with the HSE Personal Information Disclosure Standard

Audit logs in formats accepted by IMC, CORU, IDCN, and NMBI

Integration-ready for HealthLink + Eircode-based addresses

Irish Health Act 2014 §73 patient confidentiality + audit retention

EU AI Act — Brigid as Human-Oversight AI

Brigid is operated as a high-risk AI system under Regulation (EU) 2024/1689 — Annex III point 5 (decision support for healthcare) plus Annex I once the medical-device CE marking completes. We maintain documentation, transparency, logging, and human-oversight controls required under Articles 12, 14, and 50.

EU AI Act Art 12 — append-only log of every AI inference, retained for the lifetime of the device plus 10 years (MDR technical documentation)

EU AI Act Art 14 — clinician must verify every AI output before action

EU AI Act Art 50 — patients are clearly informed they are interacting with AI (the Brigid orb)

Per-patient permission toggles enforced at the data layer — see Privacy Policy → AI Features

EU Medical Devices Regulation (MDR Class IIa)

DJG Media Limited (trading as MedPro AI), CRO No. 762838 is undergoing conformity assessment as the legal manufacturer of a Class IIa medical device under EU MDR 2017/745, classified per Annex VIII Rule 11 (software as a medical device). The CE mark is not yet held. See the dedicated Medical Device declaration for the current certification status and post-market surveillance approach.

MDR Annex VIII Rule 11 — software intended to drive a clinical decision is Class IIa

MDR Articles 83–86 — post-market surveillance system in place

Clinical Evaluation Plan + Risk Management File maintained per ISO 14971

Notified body engagement + UDI assignment under MDR Article 27 (certification in progress)

Certifications & Audits

We claim only what is true today. GDPR compliance is live and self-assessed — no certification scheme currently exists for GDPR itself. Our platform undergoes continuous external security auditing by Aikido Security, whose public report is linked from the footer of this site. We do not currently hold SOC 2, ISO 27001, or HIPAA certifications, and we make no such claims.

GDPR — compliance programme live and self-assessed (no GDPR certification scheme exists)

Continuous external security auditing via Aikido Security — public report linked in the site footer

EU MDR Class IIa conformity assessment underway — CE mark not yet held

No SOC 2, ISO 27001, or HIPAA certifications held or claimed