ISO 27001
CertifiedInformation security management system.
The evidence
Assurance you can inspect.
Review the scope, dates and findings.
Reports are available on request, under NDA where required.
SOC 2 Type II
Independent attestationControls assessed over a reporting period.
ODPC
RegisteredData controller and processor in Kenya.
DHA
Claims system certifiedFirst certified claims system. Fourth company certified by DHA.
View on the DHA registerPenetration testing
August 2026Findings remediated and retested.
The controlsBuilt into the work.
Built into the work.
Visible to your team.
Protect the data. Limit the access.
Keep the evidence.
Encrypted in transit and at rest.
TLS 1.2+ protects connections. AES-256 protects stored data. A dedicated key management service manages keys and scheduled rotation.
Access limited to the job.
Role-based permissions follow least privilege. No shared credentials or standing access to production.
Your identity controls, connected.
MFA is enforced. Enterprise SSO supports SAML and OIDC, keeping your identity provider central to access control.
Hospital data kept separate.
Logical tenant isolation separates your facility’s data and restricts access across organisations.
Actions you can trace.
Access, changes, recommendations, overrides and submissions are logged by user, role and time. Audit records are exportable for review.
Monitoring around the clock.
24/7 logging, alerting and anomaly detection help identify suspicious activity and trigger investigation.
Clinical decisions stay human.
Clinicians review and approve final records. Claims automation follows agreed permissions, with exceptions assigned for review.
An accountable response.
A named security contact and documented incident response and breach notification processes make ownership clear.
Safe integrationYour HMIS stays.
Your HMIS stays.
The boundaries are clear.
Ginja AI works alongside your existing system. Data access, processing and write-back are defined for the services you choose.
- 01
Agree the access.
Define the records, interfaces and permissions each product needs before connecting.
- 02
Control the action.
Keep clinical approval with your staff. Set permissions for write-back, submissions and exceptions.
- 03
Manage the change.
Ginja AI handles SHA and DHA specification changes behind the agreed interface. Changes affecting your system are coordinated with your team.
Data handlingClear answers.
Clear answers.
Before you connect.
Know who can access data, what AI can do and how actions are reviewed. Put those answers in the agreement.
Can patient data be used to train AI?
Your data agreement defines permitted uses, including whether any data may be used for model improvement. It explicitly covers clinical records, recordings and third-party processing, so your team can review the terms before rollout.
Who controls access and the patient record?
Your facility sets authorised roles and retains control of its clinical record. Ginja AI’s controller and processor responsibilities are defined by the processing activity and your agreement; ODPC registration does not replace your facility’s own obligations.
What can our IT and governance teams review?
Request the architecture and data flows, security reports, incident procedures and continuity and recovery arrangements. Agree support responsibilities, recovery objectives and notification commitments before deployment.
Your next stepGive your board evidence.
Give your board evidence.
Give your team confidence.
Get the documents behind the controls and walk through them with our security team.
- Certificates & audit reports
- Architecture & data terms
- Testing & incident procedures