We're publishing our compliance posture in full — not because we're required to, but because we believe that anyone who stores their health data with us deserves complete transparency about how we protect it. This document summarises where we stand on GDPR alignment, HIPAA-adjacent controls, encryption, access management and data residency.
GDPR alignment
While GCC countries are not subject to EU GDPR directly, Looms operates to GDPR-equivalent standards as our baseline. This includes lawful basis documentation for all data processing, data subject rights fulfilment (access, rectification, erasure, portability), data processing agreements with all sub-processors and privacy-by-design implementation across all new features.
Encryption
All health data is encrypted at rest using AES-256. All data in transit uses TLS 1.3 minimum. Encryption keys are managed using hardware security modules and rotated annually. Database-level encryption is applied in addition to storage-level encryption.
Access management
Access to patient data by Looms staff is restricted to specific roles on a need-to-know basis, governed by role-based access control and reviewed quarterly. Every access event by Looms staff to production patient data is logged and auditable. Access to our production environment requires multi-factor authentication and occurs through a privileged access management system.
Third-party auditing
We engage an independent security firm to conduct penetration testing twice per year. The most recent test was completed in December 2024, with all critical findings remediated within 14 days of the report. Our ISO 27001 certification audit is available on request.