The questions we always get

Yes. Your data is protected by encryption both in transit and at rest. Consultation audio is processed only to generate the clinical documentation and is never used to train artificial intelligence models. You also keep control and ownership of your information at all times. Before any record is saved, the clinician always reviews and approves the generated content, which ensures the documentation is accurate and of high quality.

Yes, at rest and in transit. Communications run over HTTPS/TLS 1.3 between healthcare staff devices, our servers and hospital systems (HIS and EHR), storage is encrypted and keys are rotated regularly. No intermediate party ever sees the data in plaintext.

In cloud regions inside the European Union, and nowhere else. There are no international transfers by default, and the deployment follows European data protection and digital sovereignty rules. If your case calls for it, we also deploy on-premises or in your private cloud.

Clinical data does not: the infrastructure is European end to end and processing stays inside your authorised perimeter, with network segmentation, per-tenant isolation and egress controls.

As a general rule, Omniloy does not transfer personal data internationally. Some services may involve providers located in Colombia, Ecuador, Argentina or Panama, and in those cases the safeguards in Chapter V of the GDPR apply: an adequacy decision where one exists, or the European Commission's standard contractual clauses. You can request a copy of those safeguards at dpo@omniloy.com.

Only the people who need it to do their job. Access control is role based (RBAC), with granular permissions per service, specialty and site. Multifactor authentication is mandatory for every staff member and for administrative integrations, corporate SSO is supported (SAML and OIDC), sessions expire automatically and access is revoked immediately when it should be.

With continuous 24/7 monitoring of the whole platform and real-time alerts on performance, security or clinical quality anomalies. There is an incident response plan with committed reaction times, periodic sample review and audited KPIs for accuracy, latency and completeness.

End to end. We keep an immutable, signed record of every interaction: who accessed it, what was generated, what the clinician validated and what was changed afterwards. Traceability runs from voice capture to the final document in the health record, and it is exportable on demand for internal audits, external reviews or regulatory inspections.

We never use your data to train our models: your data is yours. We process it to deliver the service you contracted, and nothing else. Personal information is pseudonymised before any transcription is processed, we sign a data processing agreement with every customer, we keep the record of processing activities, and we do not pass that data to third parties outside the delivery of the service: only the processors needed to deliver it are involved, each under contract.

The full detail, with legal basis, purposes and recipients, is in the privacy policy.

Never. Neither identified nor anonymised. And this is not a statement of intent: it is set out explicitly in the contract. Your data works for you, not for our models.

Yes, by default for every new deployment, under Article 35 of the GDPR. We analyse the risks to the rights and freedoms of patients and professionals, document the mitigation measures and review the assessment periodically with your organisation's data protection officer.

For as long as it is needed to fulfil the purpose it was collected for and to determine any liabilities arising from it, plus the periods set by records and documentation rules. Once it is no longer needed, it is deleted with security measures that guarantee pseudonymisation or full destruction.

By writing to dpo@omniloy.com, at any time and free of charge: access, rectification, erasure, restriction and objection. We need to verify the identity of whoever asks, so the request should include full name, the specific request, an address for notifications, the date, a signature and a copy of a valid identity document.

If something does not go the way it should, complaints go to the Spanish Data Protection Agency (www.aepd.es).

The personal data we process inside the service is not passed to third parties outside the delivery of that service. Internally, only the people who need it for the activity they carry out can reach it.

For the contact details you leave on this website, the privacy policy sets out the recipients: they may be shared with companies linked to the Lãberit Group for the same purposes we have informed you of, and with the competent authorities when a legal obligation requires it. When we delegate processing to a provider, we only use processors that offer sufficient guarantees.

No. As stated in our privacy policy, Omniloy minimises and anonymises personal data, does not use biometric data, does not build intrusive profiles, applies advanced security measures and does not transfer data outside the European Union without adequate safeguards.

The ones we can evidence in Omniloy's own name:

• Spanish National Security Scheme (ENS), High level (Royal Decree 311/2022), audited by an accredited body. The certificate is published in the CCN registry: see it here.
• CE marking as a medical device under Regulation (EU) 2017/745 (MDR).
• ISO 13485, quality management system for medical devices.
• ISO 9001 and ISO 14001, quality and environment, certified by Bureau Veritas.
• ISO/IEC 42001, artificial intelligence management system, certified by Bureau Veritas.
• Innovative SME mark from the Spanish Ministry of Science, Innovation and Universities, under tax ID B75956227.

Each one, with its scope, is on the security page.

Not in Omniloy's own name, and we would rather say so plainly before it comes up in a tender. What we do is keep our systems aligned with the controls of ISO/IEC 27001 and of the ENS, which is a different thing from declaring the management system conformant with the standard.

The security certification we do hold, and that you can check for yourself in the CCN registry, is the Spanish National Security Scheme at High level.

HIPAA has no certification scheme, so nobody can show you a compliance certificate, us included. What we do is align with it for the handling of protected health information (PHI): controls from the Privacy, Security and Breach Notification Rules, PHI encryption, least-privilege access, audit logging and Business Associate Agreements (BAA) available for deployments that require them.

The AI Act has no certification scheme either, so we talk about alignment with Regulation (EU) 2024/1689. Our AI systems are classified as minimal or limited risk and we use no prohibited or high-risk systems. There is a risk classification done by our compliance team, a documented clinical FMEA, a model registry, meaningful human oversight and full traceability of every AI-assisted decision.

Yes, under Regulation (EU) 2017/745 on medical devices (MDR). That means full technical documentation, risk management per ISO 14971, conformity assessment and active post-market surveillance, all inside an ISO 13485 quality management system with annual audits.

They are public and they are right here: ENS Security Policy, AI Policy, Privacy Policy and Organization Policy. If your vendor assessment needs something that is not published, just ask us.

No. There is a person at the end of every decision that matters. The copilot drafts the note and proposes the coding, and the doctor confirms it or changes it. The pharmacy agent neither prescribes nor validates: it gathers what you would otherwise look up in several places and puts it in front of you with its source, but you are the one who decides and signs. And in a conversation, when the case gets complicated, the agent steps aside and hands it to a person.

It says so. If the sources you have switched on do not support an answer, it does not fill the gap. And if the conversation needs someone from your team, it transfers with a summary of the context so nobody has to start from scratch.

From your sources, not from a generic knowledge base: clinical guidelines, the hospital formulary, product information sheets, medicines databases and scientific studies. Each source is switched on or off from the platform, it is configured per hospital, it can be changed at any time and every answer cites the one it came from.

Yes, and it is a right, not a courtesy. Any user is entitled to be told when they are interacting with an AI system, to ask for explanations about an automated decision, to request human intervention in important decisions, to ask for correction or review and not to be subject to automated decisions without safeguards. It is set out in our privacy policy and it is how the agents are designed.

On a test bench of our own. No agent talks to a patient without being tested first, and no change ships without running the whole test suite again. Every conversation is logged so it can be reviewed afterwards, and your team can leave its feedback right there.

We have more than 15 integrations with HIS, EHR and ERP systems, including those that run client-server. Today we work with IQVIA, Cegid Ekon, Sina Suite, Nextech, SAP, InterSystems, Abucasis, ehCOS by NTT DATA, Digimevo and History Clinical, among others.

An agent like admissions goes live in two to three weeks: integration with your HIS or EHR, configuration of the conversational flows and testing with your team. No extra training is needed for your staff, and agents are deployed one at a time and added up.

72 languages, Spanish, Catalan, Galician, Basque and English among them. The agent detects the patient's language and switches in real time during the conversation.

Your team does, from the platform. Which clinical guidelines go in, what each agent may do and where it stops is yours to decide: you edit it, you save it and the agent answers differently on the next call. No ticket, no waiting for a deployment and no asking us for permission. And never on your own: our team is behind you whenever you need it.

Yes. The usual setup is a deployment in European Union cloud regions, but on-premises installation or the customer's private cloud is available for cases with special requirements.

Yes, and the dashboards are yours. Each panel is built with the metrics that matter in your service, filtered by date range and by product, and you can click into any bar to see the calls behind it. On screen or over the API, with role-based access: nursing sees its own, admissions sees its own.