Trust Center
At Clinion, we take AI development seriously. Our approach isn’t just about innovation; it’s about doing it correctly. With fairness, transparency, security, and accountability as our foundation, Clinion is paving the way for AI in clinical trials, ensuring its benefits are accessible to all while maintaining the highest ethical standards.
Below, we detail the key security, privacy, and compliance practices we follow to protect customer information and maintain high standards across our services.
Responsible AI
The rapid adoption of AI technologies has brought forth significant challenges, including concerns related to bias, social manipulation, and ethical implications. Consequently, the ethical and responsible deployment of AI has become a critical priority.
Responsible AI extends beyond developing efficient systems. It emphasizes ensuring fairness, mitigating bias, prioritizing safety, and aligning with fundamental human values.
- Accountability : Clinion ensures clear accountability through a Human-in-the-loop (HITL) interface, where human oversight is integrated into AI-driven processes.
- Transparency : Our systems are fully validated to ensure that there is consistency. We also ensure transparent handling of data by clearly outlining how data is processed, stored, and used throughout the system.
- Inclusiveness : Inclusiveness is a major challenge in AI systems. Clinion systems are designed to reduce bias and promote inclusivity of data by selecting multiple sources and not relying on a select few. It is our constant endeavor to be more inclusive.
- Privacy & Security : Clinion partners with Azure OpenAI and utilizes enterprise licensing to ensure that all AI applications are built on a secure, scalable foundation. Our secure architecture upholds privacy and protects sensitive customer data, reinforcing our commitment to data security.
- Reliability & Safety : Clinion’s models undergo thorough validation to ensure their accuracy and reliability. We also integrate safety constraints to mitigate potential risks, ensuring that our solutions function securely and efficiently in clinical trial environments.
- Fairness : Clinion is dedicated to ensuring fairness in all AI-driven processes. We employ advanced techniques for bias detection and mitigation, utilizing fairness metrics to assess and improve the equity of our AI models.
Security, Privacy, and Compliance
Adhering to Industry Standards and Best Practices
Clinion is committed to ensuring our customers’ compliance while using our solutions. Our Information Security and Compliance program actively monitors and follows the compliance, regulatory, and best practice frameworks.
Our internal processes are guided by the following industry best practices to enhance our security program:
- NIST SP 800-18 – Security Plans for Federal Information Systems
- NIST SP 800-34 – Contingency Planning Guide
- NIST SP 800-37 – Risk Management Framework
- NIST SP 800-39 – Managing Information Security Risk
- NIST SP 800-43 – Guide to Enterprise Patch Management
- NIST SP 800-53 r5.1 – Security and Privacy Controls for Information Systems
- NIST SP 800-61 – Incident Management
- NIST SP 800-84 – IT Testing, Training, and Exercise Guidelines
- NIST SP 800-137 – Continuous Monitoring Framework
- ISO 27002:2022 – Information Security Controls
- HIPAA (Health Insurance Portability and Accountability Act)
- GDPR (General Data Protection Regulation)
Certifications
Clinion works with trusted third-party auditors to implement and get certified on SOC 2 Type II and ISO 42001:2023 AI Management System, focusing on the security, confidentiality, and availability of our products and infrastructure. ISO/IEC 42001 is designed to be compatible with existing quality management systems. For organizations that use, develop, or provide products or services that utilize AI, it specifies requirements and guidance for establishing, implementing, maintaining, and continually improving an AI management system.
Clinion is ISO 9001:2015 and ISO 27001:2022 certified by DBS Certifications, and our application is certified for GDPR and HIPAA compliance by Valency Networks.
Personnel Security
At Clinion, we prioritize hiring qualified candidates by conducting thorough background checks. To ensure the proper handling of sensitive data and secure processes, all employees receive annual training in security, privacy, and regulatory compliance based on their job-specific roles. Access to sensitive information is granted only after personnel agree to our comprehensive internal policies, which include non-disclosure, confidentiality, security, and acceptable use requirements. This ensures all team members adhere to our rigorous standards for data protection.
Data Privacy
Clinion ensures that any personally identifiable information (PII) collected within our products is limited to what is strictly necessary for user access. Our privacy program is designed in compliance with GDPR, safeguarding data subject rights. For any inquiries related to GDPR, customers can direct requests to their designated point of contact.
Quality Management System
Clinion upholds a robust Quality Management System (QMS) aligned with ISO 9001:2015 standards for all product development. This system ensures our products consistently meet customer expectations, and any deviations are promptly addressed to maintain high-quality standards.
Product Protection and Security
- Application Defense Strategies :
We utilize recognized security technologies to safeguard our product infrastructure against external threats, including SQL injection, cross-site scripting, man-in-the-middle attacks, and other vulnerabilities outlined by the OWASP Top 10. Clinion also ensures that all dependencies in its supply chain are closely monitored to establish a secure base for our products. - Vulnerability Management Process :
Clinion runs a dynamic vulnerability management system to assess risks in both proprietary code and third-party software, as well as in our product infrastructure. While we do not offer a bug bounty program, external entities can report discovered vulnerabilities via security@clinion.com. Unauthorized testing of Clinion systems requires prior written approval. - Incident Management and Monitoring :
Our team continuously monitors our infrastructure from both security and operational perspectives, ensuring the confidentiality, integrity, and availability of our products and customer data. We utilize automation alongside a well-defined process to track platform traffic and authentication, enabling rapid detection and response to any potential security threats. - Third-Party Software Compliance Review :
All software components within Clinion platforms are subjected to an annual security review to confirm alignment with privacy, security, and regulatory expectations. Subprocessors involved in the delivery of Clinion products also undergo thorough evaluations, with customers notified where applicable. - Disaster Recovery and Continuity Plan :
To fulfill our recovery time and recovery point goals, Clinion has a comprehensive Disaster Recovery and Business Continuity Plan (DR/BCP), which undergoes testing and training on a yearly basis. Any discrepancies identified during testing are carefully documented and used to enhance the process. - External Security Assessments :
Clinion enhances the robustness of its security practices by engaging third-party security professionals to conduct annual assessments of Clinion products, integrating their findings into our vulnerability management system for continuous improvement.
Data Security Measures
- Segmentation and Protection of Customer Data :
At Clinion, we prioritize the security of customer data by ensuring it is logically separated within our platform. Each client’s data is securely isolated from others, maintaining confidentiality and integrity in multi-tenant environments. - Comprehensive Data Protection :
Clinion guarantees the durability of all customer data by leveraging highly resilient infrastructure. Our cloud storage solutions are designed to ensure that data remains protected, even in the event of unexpected incidents, so you can trust that your information is safe with us. - Reliable Data Backup :
To further secure customer data, Clinion performs automatic backups to multiple redundant data centers. These backups are consistently monitored to ensure data continuity and safeguard against potential data loss caused by unforeseen events. - Robust Encryption Standards :
Clinion employs industry-leading encryption practices for both data at rest and in transit. We use AES256-CBC encryption, compliant with FIPS 140-2 standards, for all stored data, and TLS 1.2 or higher encryption protocols for data transmission, providing comprehensive protection at all stages.
Access Control
- User Authentication & Control :
Clinion employs robust authentication methods to manage platform access, including multi-factor authentication, to ensure that only authorized users can log in. - Principle of Least Privilege :
At Clinion, access to customer data is tightly controlled. Our staff does not have automatic access to sensitive information. Instead, any access is granted only when necessary, through a formal approval process. We follow the zero-trust model to ensure the minimum level of access required for each task, enhancing security at every level. - Continuous Monitoring & Auditing :
We maintain a comprehensive auditing system to track access to our platform. All user activities are consistently monitored for any suspicious behavior, and audit logs are securely stored in a way that prevents tampering, ensuring a complete and transparent record of platform usage.