## Architecture, deployments, and technology

<FAQ
 withHeader={false}
 condensed={true}
 faqs={[
 {
 question:
 'Do you have a high-level architectural diagram of the Awell system and all its different components?',
 answer:
 'Yes! Have a look at our architecture diagram <a href="https://drive.google.com/file/d/1bsn65XMsZt8XNsMEfZ5zNucqsXRHdAwD/view?usp=sharing" title="Awell Architectural Diagram">here</a>',
 },
 {
 question: 'Where is your stack hosted?',
 answer:
 'Our stack is hosted on Google Cloud and can be deployed in several geographical locations for compliance reasons.',
 },
 {
 question: 'How scalable is Awell Health?',
 answer:
 'Our integrations and infrastructure are designed to handle large volumes of patients. Have a look at our <a href="/system-status">system status page</a> for more information.',
 },
 {
 question:
 'How will you ensure geo-fencing, such that data related to a geography (e.g. US or UK) resides in servers located appropriately?',
 answer:
 'Our deployments are regional, so by design the data never leaves the region.',
 },
 {
 question:
 'How do you support multiple environments? Like Development/Test/Production?',
 answer:
 'We currently offer access to two environments: Sandbox and Production. We have internal-facing environments to support the software development lifecycle. We are able to flexibly support your ongoing integration and testing needs, so please feel free to discuss them with you.',
 },
 ]}
/>

## Compliance & security

<FAQ
 withHeader={false}
 condensed={true}
 faqs={[
 {
 question: 'Is your system secure?',
 answer:
 'All interactions with our software as well as all data processing are end-to-end encrypted according to standards set for the banking industry. We are GDPR and HIPAA compliant and ISO27001 certified. That is a certification for how we deal with information security. We do regular internal and external audits of our processes as well as our infrastructure in order to evolve our security continuously.',
 },
 {
 question:
 'Are you SOC 2 certified (developed by the American Institute of CPAs)?',
 answer:
 'We are not SOC 2 certified yet, but we are ISO 27001 certified. We work with some of the biggest pharmaceutical and medical device companies worldwide, which each have strict security and compliance requirements. Compliance has never been an issue with our customers in the past, and we are confident that it won’t be in the future.',
 },
 {
 question: 'Is data encrypted?',
 answer: `
Data is encrypted at rest and in transit.</>
Our database is deployed on a kubernetes cluster in the Google Kubernetes Engine. It is backed by a kubernetes persistent volume, which is covered by Google Cloud’s Default encryption of data at rest.
In cluster db connections use the HTTPS channel and therefore benefit from encryption in transit through TLS. HTTP access to the database is disabled to prevent connections without encryption in transit.
 `,
 },
 {
 question: 'How often are pen tests & audits performed?',
 answer:
 'Penetration tests are scheduled every year and performed by an external party.',
 },
 {
 question:
 'Could you give me some info on your disaster recovery/back up setup?',
 answer:
 'Our product is deployed on Google Kubernetes Engine, and we use regional clusters which already come with built in redundancy (3 zones per region). Adding another layer of redundancy (replicate the US deployment to different data centers for example) is on the technical roadmap but not available yet. We have daily backups in all environments, and the provisioning of new environments is fully automated so in the worst case scenario where a google data center is fully down we can create a new deployment in a different datacenter and be up and running with the latest backup in a day max (as defined in our ISMS disaster recovery policy), but realistically it can be as quick as one hour.',
 },
 {
 question:
 'Do you require multi-factor authentication on all enterprise applications and production systems?',
 answer: 'Yes.',
 },
 {
 question:
 'Does your company assess the security and privacy practices of all third-party companies with access to customer data?',
 answer:
 'Yes. We annually review all 3rd parties according to our Supplier Security Policy (part of our Information Security Management System which is audited yearly as part of our ISO-27001 certification). This includes risk assessments, background verification checks, ensuring the right clauses are part of the contract, training and awareness, etc.',
 },
 {
 question: 'How does your company securely back up all product data?',
 answer:
 'All data is backed up daily and stored for 30 days in Google Cloud. Data is encrypted in transit and at rest.',
 },
 {
 question:
 'What are the measures that are taken to prevent malicious spread/malware introduction to customers?',
 answer: `We follow industry standard best practices to prevent malicious code to be included in our web applications (HTTPS traffic allowed only, up to date certificates, user input sanitisation, no 3rd party scripts beyond trusted partners, etc.).
 As part of our ISO27001 certification, all of our staff members are required to keep their devices secure through antivirus & firewall software.
 `,
 },
 ]}
/>

## Data privacy

<FAQ
 withHeader={false}
 condensed={true}
 faqs={[
 {
 question: 'Are you HIPAA and/or GDPR compliant?',
 answer: 'Yes, the Awell platform is both HIPAA and GDPR compliant.',
 },
 {
 question: 'How does your system handle PII/PHI data storage?',
 answer:
 'PII & PHI data is stored in a graph database (to support orchestration) and in Google BigQuery (to support analytics) on Google Cloud servers. You decide how much PII/PHI data you want to share with us, our product can also work with completely anonymous patients.',
 },
 {
 question:
 'If your system will be storing PII/PHI data, are you open to signing a Business Associate Agreement (BAA)?',
 answer: 'Yes, we can sign a BAA with you.',
 },
 {
 question:
 'How does Awell Health prevent sensitive (medical) data from being leaked?',
 answer: `
We follow industry standard best practices to reduce the surface area of attack on the databases containing sensitive data (no sensitive data in logs, strong password rules enforced for database access, no shared credentials for database access, no public endpoint for databases, etc.). Internal access to those databases is granted only when necessary (ie. when troubleshooting issues).
We follow industry standard best practices for data encryption (data is encrypted at rest and in transit).
We are ISO27001 certified, which requires following strict hardware and software controls and staff training to prevent data leaks.
In our multi tenants deployments, all data is logically isolated by tenant to prevent leaks between customers.
 `,
 },
 ]}
/>

## Usage

<FAQ
 withHeader={false}
 condensed={true}
 faqs={[
 {
 question: 'What is a (monthly) active patient?',
 answer: `
A patient is active in a preceding month if any of the following occurred for that patient:
‍
<ul>
<li>Care flow/pathway was started</li>
<li>Action was activated</li>
<li>Reminder was triggered</li>
</ul>

<div>
 Please note that the patient does not have to complete an action to be
 considered active. For example: if a reminder was sent to the patient, the
 patient is considered active.
</div>
<div class="mt-4">
 Whether a patient has 1 active flow and 1 activity in a given month, or 100
 flows with 1000 activities, that patient will be billed only once in that
 month
</div>
`, }, ]} />

## Data

<FAQ
 withHeader={false}
 condensed={true}
 faqs={[
 {
 question:
 'Are all questions or data points and the corresponding answers uniquely identifiable in your system?',
 answer:
 'Yes. In addition, questions can be given a human readable identifier to support analytics queries.',
 },
 {
 question:
 'Can we assign custom attributes/tags to the Pathways? Will these custom tags be available in Google BigQuery?',
 answer: 'Not yet, but this feature is on our roadmap.',
 },
 ]}
/>

## Medical Device Compliance

<FAQ
 withHeader={false}
 condensed={true}
 faqs={[
 {
 question: 'Is the Awell Platform a medical device?',
 answer: `No, the Awell Platform is not a medical device. It is general software used for building and operating care flows.
 However, depending on its intended purpose, a care flow built and operated on the Awell platform could be a medical device, according to the MDR(EU Medical Device Regulation) or FDA (US Food and Drug Administration). Care flows might therefore require CE certification or FDA approval.
 We recommend all our customers to be aware of the potential regulatory requirements before implementing their care flows.`,
 },
 {
 question:
 'Do I need to certify my care flow under the Medical Device Regulation (MDR)?',
 answer: `If your care flow is intended only to collect information from patients and send it to a healthcare professional, then it most likely isn’t a medical device. Examples of care flows that probably don’t require a CE certification are onboarding care flows, care flows with pre-consultation questionnaires, etc.
 It is most likely a medical device if your care flow is designed for diagnosing, monitoring or treating patients. Please be aware that if you are a health institution, you might only need to comply with article 5(5) of MDR (in-house medical devices). Go through article 5(5) and the <a href="https://dskb.dk/wp-content/uploads/2021/09/In-house-guidance_stakeholders.pdf" title="Guidance for in-house devices">guidance for in-house devices</a> and check if you are eligible for this type of assessment. You can use <a href="https://health.ec.europa.eu/system/files/2020-09/md_mdcg_2019_11_guidance_qualification_classification_software_en_0.pdf" title="MDCG 2019-11">MDCG 2019-11</a> for guidance on classifying your care flow.
 Note: according to the <a href="https://health.ec.europa.eu/system/files/2022-12/md_borderline_manual_12-2022_en.pdf" title="borderline manual">borderline manual</a>, released in December 2022, any simple calculation requiring patient variables is considered a medical calculation, hence a medical device. For example, a calculation of stroke risk for patients with atrial fibrillation using the CHA₂DS₂-VASc Score falls under the medical calculations requirements.`,
 },
 {
 question: 'Do I need FDA approval for my care flow?',
 answer: `Depending on its intended purpose, a care flow built and operated on the Awell platform could be a clinical decision support software (CDS) with device functions. Look at the <a href="https://www.fda.gov/media/109618/download" title="Clinical Decision Support Software Guidance">Clinical Decision Support Software Guidance</a> examples and see if your care flow fulfils the criteria. You can also find guidance on FDA exemptions in the <a href="https://www.fda.gov/media/80958/download" title="Policy for Device Software Functions and Mobile Medical Applications Guidance">Policy for Device Software Functions and Mobile Medical Applications Guidance</a>.We recommend all our customers to be aware of the potential regulatory requirements before implementing their care flows.`,
 },
 {
 question: 'Are you ISO 13485 certified?',
 answer:
 'No, Awell is not ISO 13485 certified since it does not manufacture medical devices. We do care about quality and therefore follow industry best practices.',
 },
 ]}
/>

If you can't find what you're looking for, you can always send us a message over Intercom with your enquiry.