European Union

Status: Not enabled — assessment required

GDPR (Article 9 health data), ePrivacy, EU MDR/MDCG SaMD qualification where applicable, and the EU AI Act's human-oversight obligations.

MedXline is not enabled for production use in this region until regional legal, clinical, security, and data-residency reviews are complete. Nothing on this page is a certification or compliance claim.

What MedXline is designed to support

GDPR-ready controls: consent versioning, purpose-scoped access, auditability, data-subject request handling
Human-oversight AI obligations — the platform's assist-only, human-in-the-loop architecture is designed for this model
EU data-residency deployment as a provisioning option

Current platform readiness

Hash-chained audit logging with exportable evidence packs
Role- and tenant-scoped access control enforced by build-time verification gates
Consent versioning and break-glass access with recorded justification
Assistive, human-reviewed AI with runtime guardrails, kill switches, and audit trails
Secret scanning, dependency review, and release verification gates in the delivery pipeline

Required reviews before launch

Legal review — ROPA, lawful-basis and Article 9 mapping, DPA/SCC subprocessor chain, DPO/representative designation
Security review — DPIAs for high-risk flows (patient intake, AI-assisted summaries)
Clinical review — EU-market clinical content
Regulatory review — MDCG SaMD qualification and EU AI Act classification

Current launch blockers

ROPA and DPIAs not yet produced
Subprocessor DPA/SCC chain not yet in place
EU-isolated residency profile not yet provisioned
DSAR service-level workflow needs EU-grade assessment

Localization

Per-country languages and EU legal pages not yet built.

Next step

Produce the processing inventory (ROPA seed) from the platform's data-domain map, then run DPIAs on the two highest-risk flows.

Operating in European Union?

Tell us about your organization and regulatory context. We will share a candid readiness assessment for your region — including what remains blocked.

Explore the platform Contact us

Current platform readiness

Hash-chained audit logging with exportable evidence packs

Role- and tenant-scoped access control enforced by build-time verification gates

Consent versioning and break-glass access with recorded justification

Assistive, human-reviewed AI with runtime guardrails, kill switches, and audit trails

Secret scanning, dependency review, and release verification gates in the delivery pipeline

Required reviews before launch

Legal review — ROPA, lawful-basis and Article 9 mapping, DPA/SCC subprocessor chain, DPO/representative designation

Security review — DPIAs for high-risk flows (patient intake, AI-assisted summaries)

Clinical review — EU-market clinical content

Regulatory review — MDCG SaMD qualification and EU AI Act classification