GDPR & EHDS compliance

Technical and legal data protection at the level of healthcare institutions.

Last updated / effective: October 28, 2026

AXOTIA is designed from the ground up in full compliance with the GDPR (Regulation (EU) 2016/679) and the European Health Data Space (EHDS). The EHDS regulation entered into force in 2025 and applies in phases over the following years. This page describes in detail the technical and legal measures by which we protect sensitive medical data to the standard required of healthcare institutions.

1. Geographic and legal localisation (EU sovereignty)

The entire primary infrastructure and data backups reside exclusively within the AWS EU-Central-1 region (Frankfurt, Germany). Data is under the jurisdiction of the European Union and stored on infrastructure holding the following certifications:

  • ISO 27001 — information-security management.
  • ISO 27018 — protection of personal data in the cloud.
  • HDS (Health Data Hosting) — certification for hosting health data.

2. Legal roles for patient data and the DPA (GDPR Article 28)

  • For patient data, your dental practice retains the status of Data Controller.
  • For patient data, Axotia Operations LLC acts as the Data Processor. Axotia Inc. is the owner of the AXOTIA software and intellectual property.
  • By accepting these terms, our Data Processing Agreement (DPA) is automatically concluded, aligned with the European Commission's Standard Contractual Clauses (SCCs).

3. Encryption and isolation of health data (GDPR Article 9)

  • Medical records and X-ray images (DICOM format) are encrypted at rest with the AES-256-GCM algorithm, while TLS 1.3 is used in transit.
  • The system architecture uses logical database isolation at the tenant level (Row-Level Security / PostgreSQL Schema Isolation) within AWS — fully preventing any mixing or leakage of data between different practices.

4. Automated exercise of patient rights

  • Right to portability (Article 20): one-click export of the complete patient record in a structured, machine-readable format (JSON / FHIR).
  • Right to be forgotten (Article 17): permanent and irreversible cryptographic erasure (crypto-shredding) of data from all production servers, with automatic removal from backup archives within 30 days.

5. Supervisory authority and complaints

If you believe that the processing of your data is not compliant with the GDPR, you have the right to lodge a complaint with the competent data-protection supervisory authority in your country. Relevant authorities include:

  • Bosnia and Herzegovina: Personal Data Protection Agency (AZLP)
  • Croatia: Personal Data Protection Agency (AZOP)
  • Serbia: Commissioner for Information of Public Importance and Personal Data Protection
  • EU country: the competent supervisory authority under Article 77 of the GDPR

6. Data-protection contact

For any questions about data processing, exercising your rights or GDPR compliance, contact Axotia Operations LLC at: hello@axotia.com

We respond to all data-protection requests within 30 days, in accordance with the time limits set by the GDPR.