Security & compliance
What protects a record, said plainly — including what is next.
Zaynix Limited is the data controller for every consumer record (ICO registration ZC117578). The table below is the state of the controls as of the release this site describes, checked on 2026-10-04 against the code. A control that is not in place is listed as not in place.
Controls
Fourteen controls: eleven in place, three not yet.
| Control | State | What that means |
|---|---|---|
| Encryption in transit | Done | TLS on every connection: Let’s Encrypt certificates, auto-renewed; plain http redirects to https. All calls to third parties (identity, AI, email, billing) over HTTPS. |
| Database and cache not on the internet | Done | PostgreSQL and Redis listen only on the server’s loopback address. The application is the only thing that can reach them. |
| Host firewall and intrusion limits | Done | A provider firewall allows SSH from one allow-listed address only; fail2ban behind it. Public ports are 80 and 443 alone. |
| Security patching | Done | Unattended security upgrades on the host operating system. |
| Backups that are proven, nightly | Done | A nightly dump is restored into a scratch database and its row counts compared before it is kept; fourteen are retained; a second timer alerts if a backup is older than 26 hours. Every release takes a pre-deploy backup and verifies the schema after. |
| Identity | Done | Sign-in through Auth0 (e-mail and password; no social logins); only verified identities are linked to a record; deleted accounts cannot sign in. Accounts come through a clinic or an invitation from Zaynix. |
| Authorisation and scoping | Done | Every query is scoped to the record’s owner. A clinician reaches a record only through an explicit, audited acting-as path, and a clinician can never read a colleague’s own record. |
| Audit of writes and clinician reads | Done | Every modifying request writes an audit row with the actor and the subject; a clinician’s reads of a record are logged (one entry per page per 15 minutes) and listed in the patient’s export. Audit rows are never deleted — erasure pseudonymises them. |
| Patient Confirmation Layer | Done | No value read from a document enters a record without the patient’s confirmation; a guard on the write path refuses any other route, in test and production alike. (Readings from a connected device sync directly, as the patient chose when connecting it.) |
| AI consent and disclosure | Done | Documents a patient uploads are read by AI under the health-data consent given before anything is added to the record; the AI summaries and the assistant run only after a separate AI consent, and can be switched off. The How-we-use-AI page names the AI models we use and the data each patient-facing feature sends them. |
| Rate limiting and abuse controls | Done | Per-endpoint rate limits; production refuses to start on a default signing secret; health data responses are never cached by the browser. |
| Encryption at rest on the host | Planned | The database volume, uploaded documents and backups are not encrypted at rest today. It is on the plan without a date yet, and stated here rather than implied otherwise. |
| Off-site backup copy | Planned | Nightly backups currently sit on the same host as the live database. A separate storage location is on the plan without a date yet. |
| Independent assurance | Not started | No certification or penetration test has been scheduled. We will show progress on request rather than claim it early. |
UK GDPR
A controller that can show its working.
What exists and where it lives — so a clinic’s data-protection lead or an investor’s diligence can ask for it by name.
Lawful basis
Contract and legitimate interests for the account; explicit consent (Article 9(2)(a)) for health data, and a separate consent for the AI features, recorded per person and revocable in the app.
Rights, built into the product
Access and portability: an export from the Privacy page, or a subject access request in writing. Erasure: a request we act on within one month, saying what is kept and why. Objection and restriction: through the contact form or in writing to privacy@zaynix.health; the AI features can also be switched off in the app and the record still works.
Transparency
The Privacy Policy, Terms, Cookie Policy and the EU AI Act Article 50 page ("How we use AI") are one text, published in the app and here.
Records and assessments
A Data Protection Impact Assessment and a Record of Processing Activities are maintained and shared with clinics as current drafts under NDA; the processor register is summarised below.
Breaches
A breach register is kept; the ICO is notified within 72 hours where required and affected people where the law requires.
Clinics
When a patient connects a clinic, the clinic becomes responsible for its own clinical record; the arrangement is written into the clinic agreement signed at onboarding.
Sub-processors
Who touches the data, for what, and where.
Uploaded documents are read by an AI provider under the health-data consent every account gives before anything is added; the AI summaries and the assistant run only after a separate AI consent. The marketing site, DNS and app distribution never carry health data.
| Processor | Purpose | Location | Transfer basis |
|---|---|---|---|
| Hetzner Online GmbH | Hosting: the application, database and uploaded documents | Falkenstein, Germany (EEA) | UK adequacy regulations for the EEA |
| Auth0 (Okta, Inc.) | Identity: sign-in, password resets | United Kingdom tenant region; corporate HQ United States | Okta’s Data Processing Addendum (EU SCCs with the UK Addendum) |
| Anthropic, PBC | Reading documents, classifying medicines, describing a patient’s own results | United States | UK IDTA under Anthropic’s API Data Processing Addendum |
| Google LLC (Gemini API) | The patient assistant’s default model, and some document-reading paths | United States | UK IDTA under Google Cloud’s Data Processing Addendum |
| Deepgram, Inc. | Transcribing optional voice entry | United States | Deepgram’s Data Processing Addendum (EU SCCs with the UK Addendum) |
| Resend, Inc. | Transactional e-mail: invitations, set-your-password links, notices | United States | Resend’s Data Processing Addendum (EU SCCs with the UK Addendum) |
| HubSpot | The service desk behind the contact form (your name, e-mail, organisation and message, as a ticket) | European Union | HubSpot’s Data Processing Agreement |
| Slack Technologies | Operational alerts to the team: the error, the endpoint and a short user reference. File names and error text can reach it today, and either can carry personal details; we are removing them. | United States | Slack’s Data Processing Addendum |
| Microsoft 365 | The support and privacy mailboxes (what you write to us) | Microsoft’s data-residency terms for our tenant | Microsoft’s Data Protection Addendum |
| Stripe, Inc. | Subscription billing for consumer plans; Zaynix never sees card numbers | United States / Ireland | Stripe’s DPA with UK Addendum |
| Cloudflare, Inc. | DNS and this marketing website (no health data) | Global edge | Cloudflare DPA |
A copy of the data taken before our move on 16 September 2026 — the database and documents — remains in a paused Microsoft Azure account, in its UK and EEA regions, pending deletion. It is not in live use, and the processor register lists it. Apple distributes the iPhone app (TestFlight, App Store) and holds no health data. The full processor register, with contract references and review dates, is available under NDA.
Regulatory position
Not a medical device — and built to stay that way.
Software that informs or recommends a clinical action, or presents a result as clinical advice, is heading towards regulation as a medical device. The patient-facing product displays and records information the patient already owns: it does not diagnose, does not recommend treatment or doses, and its assistant is built not to. That line is written into the engineering rules and checked on every change that touches a prompt or a patient-facing sentence.
Displays, never judges clinically
A flag means a value sits outside the range printed on the report (or the standard range where the report printed none; "borderline" is marked as such). "Above target" means above a fixed reference line (NICE NG136). Direction words — up, down, flat — never carry meaning we invented.
EU AI Act, Article 50
A public disclosure of which model does what, with which data, is published as the How-we-use-AI page; the same page is linked from inside the product. Limited-risk classification.
Honesty under deadline
A clinically dangerous misread is treated as the most serious class of defect we have. A fix ships with the guard that catches its class, in the same release — never later.
Available under NDA, before signing: current drafts of the DPIA, the Record of Processing Activities, the processor register with DPA references, the incident-response runbook, the information-security policy and the infrastructure detail. Ask through the contact form.
Diligence questions welcome.
Ask for the documents by name; we would rather send the DPIA than a summary of it.