Anya Health
Compliant by default

How Anxya Health meets the standards that matter

Compliance isn't a bolt-on — it's built into the platform's data model, access controls and AI. Here's how Anxya is engineered around each major healthcare, data-protection and AI framework.

HIPAAGxP21 CFR Part 11GDPRISO 42001SOC 2EU AI Act

HIPAA

Health Insurance Portability and Accountability Act (US)

US federal law governing the privacy and security of Protected Health Information (PHI).

Field-level encryption (Fernet) for health data and Smart Drive metadata at rest.
Role-based access control across all six personas with least-privilege defaults.
Full audit logging of access, consent and data-export/erasure events.
Patient consent receipts and a right-to-erasure workflow.

GxP

Good Practice quality guidelines (GMP / GCP / GLP)

Life-science quality guidelines ensuring products are safe, effective and traceable.

Controlled-document workflows with review, approval and versioning.
Compliance-by-default AI output tuned to GxP expectations.
Traceable, attributable records for regulated activities.
Org Compliance Assessment maps your SOPs against GxP requirements.

21 CFR Part 11

FDA rule on electronic records & electronic signatures

US FDA regulation for trustworthy electronic records and e-signatures in regulated environments.

Immutable, timestamped audit trails on controlled records.
Electronic signature capture with attributable identity.
Document versioning with change history and access controls.
Tamper-evident storage of records and their metadata.

GDPR

General Data Protection Regulation (EU)

EU regulation protecting personal data and privacy of individuals in the EU/EEA.

Country-aware consent gate captured at registration with a signed record.
Data portability — one-click structured export of your data.
Right to erasure — permanently delete your account and associated data.
Data-minimisation and purpose-limited processing by design.

ISO 42001

AI Management System standard

International standard for establishing and governing a responsible AI management system.

Documented AI governance across model selection and usage.
Human-in-the-loop review for high-impact AI outputs.
Transparency on which models power each capability.
Risk-based controls and monitoring of AI-driven decisions.

SOC 2

Service Organization Control 2

Trust-services criteria for security, availability, confidentiality, processing integrity and privacy.

Encryption in transit (TLS) and at rest for sensitive data.
Access controls, authentication and session management.
Activity logging and monitoring across the platform.
Least-privilege, RBAC-driven confidentiality controls.

EU AI Act

European Union Artificial Intelligence Act

EU's risk-based framework regulating the development and deployment of AI systems.

Risk-tiered handling of AI features with appropriate safeguards.
Transparency notices for AI-generated content and assessments.
Human oversight for consequential outputs.
Traceability of AI usage for accountability.
Important: Anxya Health provides compliance-by-default tooling, controls and readiness to help you build and operate on these frameworks. It accelerates your path to compliance but does not itself constitute legal certification — your organisation remains responsible for its own audits, attestations and certifications.

We use cookies to run Anxya Health and improve your experience. Choose how we may use them. Read our Cookie Policy and Terms.