Committed to safeguarding
patient health data

ISO 27001 is an international information security management standard from the International Organization for Standardization and the International Electrotechnical Commission.

The leading approach and certification recognizes the health and robustness of an organization’s overall information security program, while helping an organization safely and securely manage and protect its assets in a systematic and cost-effective way.

With a focus on confidentiality, integrity and availability, Glooko achieved the three-year ISO 27001 certification after an audit by TUV, an accredited international third-party firm, that attested that Glooko is compliant with the framework.

Glooko has achieved SOC 2 Type II and SOC 3 certifications.

This globally recognized extensive reporting standard provides independent validation from a sophisticated, international, third-party auditing firm that Glooko has all the required controls in place for their employees, systems and processes to ensure the security of customers’ data, its software and company.

These accredited third-party auditors have certified that Glooko’s attested security controls and policies work extremely well in securing patient health data.

Glooko uses OneTrust, the number one privacy platform in the world to ensure website compliance with CCPA, GDPR, LGPD and hundreds of the world’s privacy laws and frameworks.

OneTrust ensures transparency and consent for online tracking.

HIPAA compliance, as supported by Glooko’s HITRUST certification, involves fulfilling the requirements of the Health Insurance Portability and Accountability Act of 1996, its subsequent amendments, and any related legislation such as HITECH.

Compliance ensures that technical, physical and administrative safeguards are in place and adhered to, and that they comply with the HIPAA to protect the integrity of patient health data.

HITRUST is the standards and certification body that helps organizations achieve information security, privacy and regulatory compliance goals through comprehensive and innovative solutions.

Glooko’s HITRUST Risk-based, 2-year (r2) Certification, the industry gold standard, combines security standards set by HIPAA, NIST, COBIT and many more.

HITRUST certification places Glooko in an elite group of organizations worldwide and proves that its attested security controls meet these standards of protecting sensitive patient health data.

HITRUST certification is a globally recognized, validated assessment conducted by an accredited Silicon Valley-based, third-party auditing firm that certifies that a company’s security policies, procedures and practices are compliant with HIPAA, the U.S. federal regulation protecting patient health data.

HITRUST certification demands best practice security safeguards and sets the highest bar for proof of a company’s security posture.

For any security issues or questions, please reach out to [email protected].

Glooko XT, our remote monitoring solution for diabetes only available in France, is recognized by the Agence Du Numerique En Sante, the French digital health agency, as a certified digital medical device, a tool designed to collect, analyze, and transmit health data.

To achieve eligibility for reimbursement for remote diabetes monitoring by the French National Health Insurance (Assurance Maladie), Glooko XT secured the required certificate proving its compliance with the Reference Framework for Interoperability and Security of Digital Medical Devices for Remote Monitoring, as well as a certificate of conformity. As a certified device, Glooko XT also possesses a CE mark and adheres to the personal data processing requirements of GDPR.

Glooko completed the National Health Service’s Data Security and Protection Toolkit, an online self-assessment tool that allows organizations to measure their performance against the ten data security standards around people, processes and technology of the National Data Guardian, an organization in England that challenges the healthcare system to help ensure that citizens’ confidential information is safeguarded securely and used properly.

All organizations that have access to the United Kingdom’s NHS patient data and systems must use this toolkit to provide assurance that they are practicing good data security and that personal information is handled correctly.

ISO Certified

ISO 13485 is an internationally recognized quality system standard that describes requirements for quality system practices and procedures in the design, development, production, and delivery of medical devices, including digital health software. Because Glooko software is classified as medical device software, we are required to meet this comprehensive quality system standard.

Regulation (EU) 2017/745 Certified

Glooko affirms that it has undergone conformity assessment to the Medical Device Regulation (EU MDR 2017/745) for CE marking in the European Economic Area (EEA). The CE marking signifies that the Glooko Web Application and Glooko Mobile Application are in conformity with the applicable requirements set out in the MDR. Medical device manufacturers in the EU and abroad must meet CE marking requirements as applicable in order to market their products in Europe.

FDA registered and 21 CFR part 11 Compliant

The Glooko platform is registered with the FDA and has received confirmation of 21 CFR Part 11 compliance via an audit conducted by a former FDA Part 11 SME and author of several FDA guidance documents.

GDPR Compliant

Glooko is committed to protecting personal data in accordance with the EU General Data Protection Regulation (GDPR), which mandates strong data protection safeguards and guarantees of individual data rights. Glooko established internal policies to support that protection, as well as external notice of what data they collect, for what purposes, and how they use them.

HIPAA Compliant

HIPAA compliance involves fulfilling the requirements of the Health Insurance Portability and Accountability Act of 1996, its subsequent amendments, and any related legislation such as HITECH. Compliance helps ensure that technical, physical and administrative safeguards are in place and adhered to that they comply with HIPAA to protect the integrity of PHI.