Security & privacy
Serious handling of sensitive conversations.
Soluna processes patient communication for private clinics, so restraint and clarity matter more than slogans. This page explains the technical controls that exist today and the requirements we establish together during a real implementation.
Privacy by design, stated plainly.
We treat healthcare communication as high-sensitivity work. The system is built to collect only what a task needs, to limit who and what can reach that data, and to keep a person accountable for the conversations that matter most.
Security in healthcare is never a single product feature. It is a shared arrangement between our platform and your clinic, defined during implementation and written down so both sides know exactly who is responsible for what.
What we do not claim
We do not claim to be certified under ISO 27001, SOC 2, HIPAA, or any similar scheme, and we make no claim of being fully GDPR compliant on your behalf. Compliance depends on how the service is configured and operated for your specific clinic, and on the legal agreements put in place. Where this page describes an approach or an intended control, it is a starting point for that work, not a certification.
Technical controls
The controls behind the conversation.
A plain-language view of how we approach the handling of patient communication. The depth of each control is confirmed against your systems during implementation.
Privacy by design
Data protection is considered from the first configuration decision, not added afterwards. Scope, access, and retention are design inputs rather than late corrections.
GDPR-aware processing
The service is designed to operate within a European data-protection framework, with processing purposes, roles, and agreements defined for your clinic during implementation.
Data minimization
The receptionist is configured to capture only the information a request genuinely needs. Less data collected means less data to protect.
Restricted access
Access to systems and records is scoped to what each task requires, rather than broad or shared permissions, and is reviewed as part of implementation.
Tenant-specific credentials
Connections to your systems use credentials provisioned for your clinic, kept separate from those of other clinics on the platform.
Secure third-party connections
Integrations with telephony, CRM, and scheduling are established over authorized, secured connections and limited to the access each integration needs.
Human oversight
People stay accountable for sensitive conversations. The receptionist hands off to your staff when a request falls outside its approved scope.
Recording controls
Whether calls are recorded, and how any recordings or transcripts are handled, is a configurable decision agreed with your clinic and its legal obligations.
Data retention
How long records and any recordings are kept is defined per clinic, so data is not retained longer than there is a reason to keep it.
Incident response
We intend for security events to be handled through a defined response process, with notification paths and responsibilities agreed with your clinic.
Administrative scope
The receptionist is limited to approved administrative communication. It does not attempt clinical judgment and does not improvise medical advice.
Technical risk assessment
Before launch, the technical setup for your clinic is reviewed so that access, connections, and data flows are understood rather than assumed.
A shared, honest division of responsibility.
Credible security is specific about who does what. Here is the difference between controls that exist in the platform today and requirements that must be established for your clinic.
In the platform today
Technical controls that are part of how Soluna is built.
- Tenant-specific credentials separating clinics
- Access scoped to what each task requires
- Configurable data minimization in the receptionist
- Approved-answer boundaries and human handoff
- Secured, authorized integration connections
Established with your clinic
Requirements defined and agreed during a real implementation.
- A data processing agreement reviewed by your counsel
- Recording, consent, and retention settings for your clinic
- The list of authorized systems and integrations in scope
- Notification paths and responsibilities for incidents
- Any sector or regional obligations specific to your practice
Editable placeholder for legal review
Documents to complete with counsel.
The items below are placeholders. They must be completed with your legal and data-protection advisers before this page is published or relied upon. Do not present any of them as finalized until they have been reviewed.
Data processing agreement
[Link or summary of the DPA governing processing, to be confirmed with counsel.]
Sub-processors
[List of third parties used to deliver the service, kept current for review.]
Retention schedule
[Retention periods for records, recordings, and transcripts, defined per clinic.]
Records of processing
[Reference to records of processing activities maintained for the service.]
Let's go through this properly.
Security questions deserve direct answers. Tell us about your systems and obligations, and we will walk through the detail with you.