Information Security Policy
Tietai is the healthcare execution platform. It connects the systems of hospitals, clinics and health services, unifies the clinical information that flows between them, and runs governed workflows and clinical AI on that information.
That information, and the systems that support it, are the most critical assets we manage. That is why its security is not a support function for us: it is the condition for providing our service.
This page summarizes the Information Security Policy approved by the management of Tiet AI, S.L. It is the reference framework for our Information Security Management System, and all our other internal policies, standards and procedures derive from it.
1. Our commitment
The Policy aims to preserve the confidentiality, integrity, availability, authenticity and traceability of the information we process, as well as the privacy of the people that information relates to. It pursues compliance with the regulations that apply to us and a balance between the level of risk accepted and the proportionate use of the organization's resources, and it serves as the framework for setting and reviewing our security objectives.
When we process clinical data, we act on behalf of the healthcare organizations that entrust us with that information and in accordance with their documented instructions. Our service model is based on processing data in transit, with early pseudonymization whenever the use case allows it and, as a general rule, without persistent storage of clinical information.
The Policy is binding on everyone at Tiet AI, S.L. (partners, management, employees and collaborating staff) and extends, through our contractual obligations, to the suppliers and third parties involved in providing the service.
2. Principles
Management is committed to the continual improvement of the management system and sets out the following principles:
- Formal security governance. A Security Committee chaired by management directs the management system, and the roles of information owner, system owner and security officer are assigned by name and documented.
- Risk-based decisions. We periodically identify and assess the risks to information and services, apply the appropriate treatment measures, and submit residual risk to management for explicit approval.
- Security by design and by default. We build security requirements into the development lifecycle, encrypt information in transit and at rest, and govern access on the principles of least privilege and need to know.
- Detection, response and recovery. We have procedures and resources to prevent, detect, respond to and recover from security incidents, as well as continuity and recovery plans that we test.
- Prompt incident reporting. Everyone in the organization must report any incident or suspected incident without delay, and we maintain the notification channels to our customers and to the competent authorities that regulations require.
- Trained and aware people. We run an ongoing training and awareness program, with specific content on processing health data, for all staff from the day they join.
- Supply chain control. We assess the security of the suppliers and sub-processors involved in the service, impose on them obligations equivalent to those we accept, and monitor their performance throughout the relationship.
- Personal data protection. We have a Data Protection Officer and process personal data in accordance with the General Data Protection Regulation and the Spanish legislation that implements it, with the enhanced safeguards that apply to health data.
- Independent verification and continual improvement. We submit the management system to internal audit and external review, and measure its performance with indicators that management reviews.
3. Reference framework
Our management system is built on the UNE-EN ISO/IEC 27001 standard and on Spain's National Security Framework (Esquema Nacional de Seguridad), established by Royal Decree 311/2022, in the category that corresponds to the health-related nature of the information we process. We also meet the obligations arising from personal data protection legislation and from the sectoral and contractual requirements that apply to providing services to healthcare organizations.
4. Review
The management of Tiet AI, S.L. reviews and approves this Policy annually, and whenever there are significant changes to the organization, the services it provides, the risks it faces or the regulations that apply to it.
5. Contact
For any question, suggestion or communication about information security, write to us. To exercise your rights or for any matter concerning personal data protection, use the data protection address.
- Information security: security@tiet.ai
- Data protection: privacy@tiet.ai
