# Patient data security and PDPA compliance

> How Zeya protects patient data: PDPA and Australian Privacy Act compliance, where data is hosted, how our AI is governed, and who our Data Protection Officer is.

URL: https://zeya.health/trust/  
Last updated: 2026-10-04

## Patient data deserves more than a badge

Clinics trust us with patient conversations, appointments and records. This page explains plainly where that data lives, which laws we comply with, how our AI is governed and what we don't do.

- [Contact our Data Protection Officer](mailto:hello@zeya.health?subject=Data%20protection%20enquiry)
- [Book a demo](https://zeya.health/book-a-demo/)

## At a glance

| Topic | Our position |
|---|---|
| Data hosting | Data is hosted in Singapore, Vietnam, and Australia. Hosting in other regions is available on request. |
| Compliance | Zeya is built to comply with Singapore's and Malaysia's Personal Data Protection Acts (PDPA), the Australian Privacy Act, GDPR, and HIPAA. Its security controls align with ISO 27001 and SOC 2. |
| Certifications | We do not currently hold third-party certifications. Our security controls are aligned with ISO 27001 and SOC 2. |
| Protection | Encryption, strict access controls and full audit logging. |
| AI and training | Clinic and patient data is not used to train AI models |
| Contracts | Data processing agreement available |
| Data Protection Officer | Agastya Samat, hello@zeya.health |

## Privacy laws we comply with

We build to the privacy law of every market we serve, and we help clinics meet their own obligations as the organisation responsible for patient data.

| Market | Law | What it means for your clinic |
|---|---|---|
| Singapore | Personal Data Protection Act (PDPA) | Consent, purpose limitation and protection of patient data. Promotional messages need prior written consent; Zeya keeps service reminders separate from marketing. |
| Malaysia | Personal Data Protection Act (PDPA) | Data protection officer and breach notification duties for data controllers; conditions for cross-border transfers. |
| Australia | Privacy Act 1988 and the Australian Privacy Principles | Australian hosting available. From 10 December 2026 practices must disclose automated decision-making in their privacy policies; we provide the description of what Zeya automates. |
| Vietnam | Personal Data Protection Law and Decree 356 | Vietnamese hosting available. Health data is sensitive and needs consent. |
| European patients | GDPR | Appropriate safeguards for EU and UK data subjects, as described in our privacy policy. |
| United States patients | HIPAA | Built to comply with HIPAA's administrative, physical and technical safeguards. |

Operating in another market? Tell us. Hosting in other regions is available on request.

## How our AI agents are governed

- **Administrative, not clinical**: Zeya's agents book, remind, answer practical questions and route requests. They never diagnose, give medical advice or present themselves as clinicians.
- **Human handover, always**: Clinical questions, complaints, side effects and anything the agent isn't sure about go to your team with the full conversation. You set the escalation rules.
- **Your rules, your content**: Agents answer from the information and policies you approve: services, prices you choose to share, preparation instructions, opening hours.
- **Every action logged**: Every message, call outcome and automated action is recorded, so you can review what was said and done, and by whom.

## Connecting your EMR and AI assistants

Digital Twin is the secure layer between your EMR, Zeya's modules and the AI assistants your team uses.

- **Access**: Read-only by default; write actions need approval.
- **Credentials**: EMR credentials are never shared with AI assistants.
- **Training**: Clinic and patient data is not used to train AI models.

## Frequently asked questions

### Where is patient data stored?

Data is hosted in Singapore, Vietnam, and Australia. Hosting in other regions is available on request.

### Is Zeya ISO 27001 or SOC 2 certified?

No. We don't currently hold third-party certifications. Our security controls are aligned with ISO 27001 and SOC 2, and we're happy to answer your security questionnaire.

### Does Zeya's AI give medical advice?

No. Zeya handles administrative and engagement tasks only. Zeya hands clinical questions to your team.

### Who is responsible for patient data?

Your clinic remains responsible for the patient data it collects; Zeya processes it on your behalf under our customer agreement and privacy policy.

### How do I report a security issue?

Email hello@zeya.health. Our security contact details are also published at [/.well-known/security.txt](/.well-known/security.txt).

### Is Zeya PDPA compliant?

Yes. Zeya is built to comply with Singapore's and Malaysia's Personal Data Protection Acts (PDPA), the Australian Privacy Act, GDPR, and HIPAA. Your clinic remains responsible for the patient data it collects; Zeya processes it on your behalf.

## Documents

- [Privacy policy](https://zeya.health/privacy-policy/)
- [Terms of service (PDF)](https://zeya.health/terms-of-service.pdf)
- [security.txt](https://zeya.health/.well-known/security.txt)

## Need our security documentation for procurement?

Tell us what your review requires and we'll send what you need.

- [Contact us](https://zeya.health/company/contact/)
- [Book a demo](https://zeya.health/book-a-demo/)