Encrypted everywhere
Data is encrypted in transit and at rest on HIPAA-eligible cloud infrastructure covered by Business Associate Agreements.
Security and privacy built for health research.
Centralive is designed around the HIPAA Security Rule’s technical safeguards, with the documentation your IRB and procurement office ask for.
HIPAA safeguards
How we protect health data.
Right people, right data
Role-based access for investigators, coordinators and data managers, with multi-factor authentication. Single sign-on (SAML or OIDC) on Institutional and Custom plans.
Audit trail
A record of access to health data and of security-relevant actions, available for review.
eConsent built in
Consent is captured in the Participant App and requested again when study documents change. Smartphone sensing is opt-in, with its own consent.
No health data in billing
Payments are handled by Stripe. No health data is ever sent to the payment provider.
Minimum necessary
Participants join with a one-time code, and each team member sees only the data their role allows.
International privacy
Ready for studies outside the US.
Relevant for teams in the UK, the EU, the Nordics and Australia.
GDPR and UK GDPR
We comply with the GDPR and UK GDPR, with an EU and UK Article 27 representative (Prighter).
EU-U.S. Data Privacy Framework
We participate in the EU-U.S. Data Privacy Framework, including the UK Extension.
Australian Privacy Principles
Our practices align with the Australian Privacy Principles.
Regional data storage
Regional data storage options are available. Ask us where your study’s data can be stored.
Documents for your review
What we can send your IRB and procurement office.
- HIPAA and security documentation for IRB submissions
- Business Associate Agreement
- Certificates of insurance (general, professional and cyber liability), on request
Vulnerability reporting
Found a security issue?
Email security@centralive.health. We reply within two working days.