Security

Security, privacy and regulatory compliance of SofIA

SofIA implements multiple layers of security to ensure protection of sensitive clinical data and compliance with international privacy regulations in the healthcare sector.

SofIA holds CE Marking as a Class I medical device and complies with ENS High Level, GDPR, and HIPAA standards.

Security Layers

Transport Security

• HTTPS (TLS 1.3) — All REST API communications
• WSS — WebSocket transcription connections

Client Isolation

• Shadow DOM — Complete DOM and style encapsulation
• Encrypted Storage — Local session data encryption

Server Security

• API Key Authentication — Request-level validation
• Audit Logging — Complete operation traceability

Data Privacy

• PII Anonymization — Automatic masking before AI processing
• No Persistence — Clinical data not stored beyond session

Communications Security

Transport encryption

The SofIA platform requires mandatory use of secure protocols for all communications:

• HTTPS (TLS 1.3): All baseUrl properties must use the https:// protocol
• WebSocket Secure (WSS): Real-time connections via wssUrl require wss:// protocol
• Mixed content prevention: The system automatically blocks insecure connections (http:// or ws://) in production environments

Authentication and authorization

• API Keys: Authentication system based on API keys with periodic rotation
• Access control: User and session-level permission validation
• Access traceability: Complete logging of all operations performed

Clinical Data Privacy

Data minimization

The platform implements data minimization principles to reduce exposure of sensitive information:

• Patient data: The patientData property should contain only information strictly necessary for the clinical context
• Anonymization: Removal of non-essential personal identifiers for processing
• Limited retention: Data is maintained only for the time necessary to complete operations

Personal information protection

• Encryption at rest: All clinical information is stored using robust encryption algorithms
• Data segregation: Physical and logical separation between different clinical contexts
• Granular access controls: Specific permissions based on roles and responsibilities

Activation safeguards

Before a consultation starts, SofIA evaluates the patient context it receives in patientdata and may warn, require an explicit confirmation, or prevent the assistant from starting. Rules are evaluated independently and the most restrictive one always wins.

Situation	Source of the data	Behaviour
Patient below the configured age	patientdata.birthDate	Depends on your account’s policy: no effect, informational warning, explicit confirmation by the professional, or block
Patient refuses the use of AI	patientdata.signedConsent.aiUse set to "refused", with the consent indicator enabled on your account	Block. Without that option enabled the rule does not apply and the value is ignored

When a rule blocks, the consultation recording, report generation and clinical-action extraction are disabled, with the reason shown to the professional. The chat stays fully available — free text, predefined questions and its own microphone dictation: the professional still needs to consult, and what the rule prevents is capturing the patient and running their transcript through the AI.

• Configurable minor policy: the age threshold and the restriction level are set per client in your Omniloy account settings. Write to [e-mail] to adjust them.
• Traceability: every warning, confirmation and block is written to the audit log, with no personal data — neither the date of birth, nor the age, nor the consent status is recorded.
• Client-side decision: the evaluation happens in the browser, before any backend call.

Regulatory Compliance

CE Mark Class I

SofIA has CE Marking as a Class I medical device, ensuring compliance with essential safety and performance requirements established in Regulation (EU) 2017/745 on medical devices.

ENS High Level

The platform complies with the National Security Scheme (ENS) at high level, in accordance with Royal Decree 311/2022, ensuring adequate protection of information and services of Spanish Public Administrations.

GDPR (General Data Protection Regulation)

• Explicit consent: Mechanisms to obtain and manage patient consent
• Right to be forgotten: Capability for complete data deletion upon request from the data subject
• Data portability: Data export in standard and interoperable formats
• Data residency: Options to maintain data within the European Union

HIPAA (Health Insurance Portability and Accountability Act)

• BAA (Business Associate Agreement): Agreements available for covered entities in the United States
• Administrative controls: Policies and procedures for PHI management
• Technical safeguards: Security measures for data access and transmission

Audit and Monitoring

Complete traceability

The system comprehensively logs all operations to facilitate audits and compliance:

• Session identifiers: Recording of userId and patientId for each operation
• Timestamps: Precise timestamp of all transactions
• Schema versioning: Version control of template used in each report
• Report persistence: Complete traceability from generation to storage

Quality monitoring

• Schema validation: Automatic verification of template through linting in the deployment process
• Performance metrics: Continuous monitoring of WebSocket latencies and error rates
• Accuracy auditing: Optional accuracy evaluation and hallucination detection processes available upon request

Quality controls

• Medical review: Integration with validation workflows by healthcare professionals
• Automatic alerts: Notifications upon anomalies or irregular behavior patterns
• Compliance reports: Automated generation of reports for regulatory audits

Next Steps

1. System architecture overview
2. Configure required properties
3. Patient data and anonymization