GDPR & AVG safeguards and AES-256 encryption.
A technical overview of Cura’s cryptographic architecture, application-layer envelope encryption, salted HMAC blind indexing, and compliance with EU GDPR & Dutch AVG regulations.
Application-Layer Envelope Encryption
Sensitive health payloads are encrypted in application memory before reaching persistent storage. Individual data keys (DEKs) are protected by Hardware Security Modules with automated key rotation.
Salted HMAC Blind Indexing
High-speed exact search for medication names and clinical targets without storing searchable plaintext. Keyed HMAC-SHA256 tokens make database indexes completely resistant to dictionary and rainbow-table attacks.
Modern TLS 1.3 Cipher Suites
All client-to-server traffic and asynchronous worker event buses communicate over TLS 1.3 with forward secrecy. Legacy, insecure cipher suites and unauthenticated HTTP endpoints are strictly disabled.
The Cura Cryptographic Pipeline
Patient & carer voice transcripts and text notes transmitted via authenticated TLS 1.3.
FastAPI service encrypts PHI payloads using AES-256 with KMS rotated data keys.
Medication names and search targets generated via salted HMAC-SHA256 blind hashing.
Encrypted ciphertext stored in dedicated cryptographic partitions alongside tamper-evident audit hashes.
Decryption keys are strictly isolated from background worker processes and third-party analytical pipelines.
GDPR & AVG Compliance Mapping
How Cura maps technical safeguards directly to EU GDPR (General Data Protection Regulation), Dutch AVG, and NEN 7510 healthcare standards.
Special Category Health Data & Consent (GDPR Art. 9)
Explicit lawful basis references and granular patient consent tracking for health data processing. Patients review every voice note and log before submission.
Security of Processing & Tenant Isolation (GDPR Art. 32 / NEN 7510)
Multi-factor authentication, fine-grained Role-Based Access Control (RBAC), and multi-tenant cryptographic isolation ensuring clinicians only access records for patients actively assigned under their care team.
Records of Processing Activities & Audit Trails (GDPR Art. 30)
Hardware and software mechanisms record activity in systems containing health data. Append-only audit logs capture user logins, log submissions, extraction runs, and decryption requests with immutable timestamps.
Data Accuracy & Verbatim Source Grounding (GDPR Art. 5(1)(d))
Policies and cryptographic procedures protect electronic health data from improper alteration or destruction. All AI entity extractions enforce strict verbatim string substring grounding checks against raw patient text.
Transmission Security & Encryption (GDPR Art. 32(1)(a))
All data in transit is encrypted using modern cipher suites over TLS 1.3. Direct API communication between mobile/web clients, asynchronous workers, and backend services is cryptographically authenticated and signed.
European Standards Alignment
Cura is engineered to conform strictly with European Union and Dutch health privacy frameworks.
Special Category Consent
Explicit lawful basis references and granular patient consent tracking for health data processing.
Healthcare Info Security
Aligned with Dutch NEN 7510 norms for information security in healthcare institutions.
Clinical Safety Officer
All deterioration alert thresholds and AI rule versions require formal Clinical Safety Officer review and approval.
Security & Privacy Questions
How are AES-256 encryption keys managed?
Cura utilizes application-layer envelope encryption managed via dedicated Hardware Security Modules (AWS KMS / Azure Key Vault). Master keys never leave KMS, and data encryption keys are rotated on regular automated schedules.
Is patient data used to train AI models?
No. Under no circumstances is Protected Health Information (PHI) used for foundation model training or retention. We maintain zero-data-retention agreements with all LLM inference infrastructure providers.
Does Cura execute Data Processing Agreements (DPA / Verwerkersovereenkomst)?
Yes. When deploying Cura within healthcare practices, GP clinics, and hospital departments in the European Union, we execute standard GDPR Article 28 Data Processing Agreements (DPAs / Verwerkersovereenkomsten) and Technical & Organizational Measures (TOMs).
Where is patient data stored?
All database instances and application infrastructure are hosted securely within European Union data regions, ensuring full compliance with European data sovereignty and transfer laws.