Data privacy & residency
- Per-tenant isolation
- No cross-customer data sharing
- Deployment-specific residency requirements
- Data minimization requirements
Trust Center
Control over data, decisions and execution.
Define which information each coworker can access, which actions require approval and when work must return to a person. Review the deployment with your security, privacy, Medical and compliance teams.
Deployment controls
What your teams need to review.
The control scope and supporting evidence are reviewed for the proposed deployment.
Cybersecurity
- Zero-trust and least-privilege principles
- Encryption in transit and at rest
- Security monitoring requirements
- Vulnerability assessment and remediation
Pharma compliance
- MLR-approved HCP content
- On-label, market-approved material
- Source traceability with citations
- Market-specific review requirements
AI quality & oversight
- Grounded, citation-backed responses
- Response quality and bias evaluation
- Prompt-injection defenses and isolation
- Restricted actions and exception review
Data boundaries
- Content classified as reference, pharma commercial or approved
- HCP experiences access the approved layer only
- SSO and role-based access
- Actions subject to workflow approval policies
Governance & auditability
- Action and approval records
- Explainable recommendations
- Human oversight where required
- Defined review and escalation responsibilities
Data boundaries
Three content layers. One rule for who sees what.
Define which information supports internal analysis and which content is approved for HCP use. Pharma commercial data access follows the permissions assigned to each role and workflow.
- Reference · clinical literature, guidelines and public evidence, used for grounding and internal reasoning
- Pharma commercial · CRM, sales, agreements and territory data, available to internal roles under role-based access
- Approved · MLR-approved, on-label, market-specific content, the only layer exposed to HCPs
Reference
Clinical literature · guidelines · public evidence
Pharma commercial
CRM · sales · agreements · territories
Approved
MLR-approved · on-label · market-specific
Governance
Autonomy, governed by your policies.
Approval paths, escalation rules and action boundaries are configured per workflow, market and risk level, and evolve as confidence and evidence grow.
Assist
Enterprise review
Define the operating requirements before deployment.
Confirm the scope, controls and responsibilities for the brands, markets and workflows you intend to deploy.
Data & access
Review data flows, hosting, retention and role permissions.
Content & approval
Define approved sources, market restrictions and the required Medical, Legal and Regulatory review.
Execution & escalation
Agree action limits, accountable owners and routes to human support.
Evidence & oversight
Review evaluation results, action records and the criteria for expanding scope.
Security documentation
Policies, measures and service providers.
How Avatia protects the information entrusted to it: our information-security policy, the technical and organisational measures we apply, and the providers we rely on.
Information Security Policy
Our information-security and cybersecurity policy (PC05-PL01), implemented within an ISO 27001:2022 framework.
Security Measures
Technical and organisational measures implemented under Article 32 GDPR.
Sub-processors
Providers engaged by Avatia in the processing of personal data.
For security or data-protection enquiries, contact dpo@avatia.ai.
Security review
Discuss your deployment requirements.
Engage our security and compliance team as part of your vendor assessment.