Patient data security · PDPA
Patient data deserves more than a badge
Clinics trust us with patient conversations, appointments and records. This page explains plainly where that data lives, which laws we comply with, how our AI is governed and what we don't do.
At a glance
| Topic | Our position |
|---|---|
| Data hosting | Data is hosted in Singapore, Vietnam, and Australia. Hosting in other regions is available on request. |
| Compliance | Zeya is built to comply with Singapore's and Malaysia's Personal Data Protection Acts (PDPA), the Australian Privacy Act, GDPR, and HIPAA. Its security controls align with ISO 27001 and SOC 2. |
| Certifications | We do not currently hold third-party certifications. Our security controls are aligned with ISO 27001 and SOC 2. |
| Protection | Encryption, strict access controls and full audit logging. |
| AI and training | Clinic and patient data is not used to train AI models |
| Contracts | Data processing agreement available |
| Data Protection Officer | Agastya Samat, hello@zeya.health |
Privacy laws we comply with
We build to the privacy law of every market we serve, and we help clinics meet their own obligations as the organisation responsible for patient data.
| Market | Law | What it means for your clinic |
|---|---|---|
| Singapore | Personal Data Protection Act (PDPA) | Consent, purpose limitation and protection of patient data. Promotional messages need prior written consent; Zeya keeps service reminders separate from marketing. |
| Malaysia | Personal Data Protection Act (PDPA) | Data protection officer and breach notification duties for data controllers; conditions for cross-border transfers. |
| Australia | Privacy Act 1988 and the Australian Privacy Principles | Australian hosting available. From 10 December 2026 practices must disclose automated decision-making in their privacy policies; we provide the description of what Zeya automates. |
| Vietnam | Personal Data Protection Law and Decree 356 | Vietnamese hosting available. Health data is sensitive and needs consent. |
| European patients | GDPR | Appropriate safeguards for EU and UK data subjects, as described in our privacy policy. |
| United States patients | HIPAA | Built to comply with HIPAA's administrative, physical and technical safeguards. |
Operating in another market? Tell us. Hosting in other regions is available on request.
How our AI agents are governed
-
Administrative, not clinical
Zeya's agents book, remind, answer practical questions and route requests. They never diagnose, give medical advice or present themselves as clinicians.
-
Human handover, always
Clinical questions, complaints, side effects and anything the agent isn't sure about go to your team with the full conversation. You set the escalation rules.
-
Your rules, your content
Agents answer from the information and policies you approve: services, prices you choose to share, preparation instructions, opening hours.
-
Every action logged
Every message, call outcome and automated action is recorded, so you can review what was said and done, and by whom.
Connecting your EMR and AI assistants
Digital Twin is the secure layer between your EMR, Zeya's modules and the AI assistants your team uses.
-
Access
Read-only by default; write actions need approval.
-
Credentials
EMR credentials are never shared with AI assistants.
-
Training
Clinic and patient data is not used to train AI models.
FAQ
Frequently asked questions
Where is patient data stored?
Data is hosted in Singapore, Vietnam, and Australia. Hosting in other regions is available on request.
Is Zeya ISO 27001 or SOC 2 certified?
No. We don't currently hold third-party certifications. Our security controls are aligned with ISO 27001 and SOC 2, and we're happy to answer your security questionnaire.
Does Zeya's AI give medical advice?
No. Zeya handles administrative and engagement tasks only. Zeya hands clinical questions to your team.
Who is responsible for patient data?
Your clinic remains responsible for the patient data it collects; Zeya processes it on your behalf under our customer agreement and privacy policy.
How do I report a security issue?
Email hello@zeya.health. Our security contact details are also published at /.well-known/security.txt.
Is Zeya PDPA compliant?
Yes. Zeya is built to comply with Singapore's and Malaysia's Personal Data Protection Acts (PDPA), the Australian Privacy Act, GDPR, and HIPAA. Your clinic remains responsible for the patient data it collects; Zeya processes it on your behalf.
Need our security documentation for procurement?
Tell us what your review requires and we'll send what you need.