Compliance Framework

Medical & Patient Data Compliance

Last Updated: 24 June 2026

EchoReport by Synthera Luminary Group is designed to meet the highest standards of medical data security and patient privacy across multiple international jurisdictions.

1. Our Compliance Commitment

Synthera Luminary Group recognises that echocardiographic data constitutes some of the most sensitive personal health information that can be collected about an individual. We have designed EchoReport from the ground up with privacy-by-design and security-by-default principles, ensuring that our platform meets or exceeds the requirements of all major international medical data protection frameworks.

Our compliance programme is built on four pillars: Data Minimisation (we collect only what is necessary for clinical documentation), Purpose Limitation (patient data is used only for the clinical purpose for which it was collected), Security by Default (all data is encrypted in transit and at rest), and Transparency (we are clear about what we collect, why, and how long we keep it).

2. Applicable Regulatory Frameworks

🇿🇦

POPIA — Protection of Personal Information Act 4 of 2013

South Africa — Primary Jurisdiction

POPIA is South Africa's comprehensive data protection law, administered by the Information Regulator. It governs the processing of personal information by public and private bodies and provides special protections for health and medical information as 'special personal information'.

Health information is classified as Special Personal Information requiring heightened protection (Section 26)

Processing of health data requires explicit consent or falls within specific medical necessity exceptions

Data subjects have rights to access, correction, and deletion of their personal information

Operators (like EchoReport) must process data only on the instructions of the Responsible Party (the practitioner)

Breach notification to the Information Regulator and affected data subjects is mandatory

Penalties of up to R10 million or 10 years imprisonment for serious violations

Trans-border data flows require adequate protection equivalent to POPIA (Section 72)

🇪🇺

GDPR — General Data Protection Regulation (EU) 2016/679

European Union, EEA, and UK (UK GDPR)

The GDPR is the world's most comprehensive data protection regulation, applying to any organisation that processes the personal data of EU/EEA residents, regardless of where the organisation is based. Health data is classified as a 'special category' requiring explicit consent or a specific legal basis.

Health data is a 'special category' under Article 9, requiring explicit consent or medical necessity basis

Data subjects have extensive rights including access, rectification, erasure ('right to be forgotten'), portability, and objection

Privacy by design and by default are mandatory requirements (Article 25)

Data Protection Impact Assessments (DPIAs) required for high-risk processing of health data

72-hour breach notification to supervisory authority; notification to data subjects without undue delay

Data Processing Agreements (DPAs) required with all processors

Fines of up to €20 million or 4% of global annual turnover for serious violations

🇺🇸

HIPAA + HITECH Acts

United States of America

HIPAA (1996) and HITECH (2009) establish the framework for protecting Protected Health Information (PHI) in the United States. HITECH significantly strengthened HIPAA's enforcement provisions and extended obligations to business associates.

All echocardiographic data constitutes Protected Health Information (PHI) under HIPAA

Business Associate Agreements (BAAs) required — available from EchoReport on request

Minimum Necessary Standard: only the minimum necessary PHI should be accessed or disclosed

Administrative, physical, and technical safeguards required under the Security Rule

Breach notification within 60 days to affected individuals, HHS, and media (if >500 affected)

Patients have rights to access, amend, and receive an accounting of disclosures of their PHI

Civil penalties up to $1.9 million per violation category per year; criminal penalties for wilful violations

🇨🇦

PIPEDA — Personal Information Protection and Electronic Documents Act

Canada

PIPEDA governs how private sector organisations collect, use, and disclose personal information in the course of commercial activities. Health information receives heightened protection under PIPEDA and provincial health privacy laws.

Health information is among the most sensitive personal information under PIPEDA

Meaningful consent required for collection, use, and disclosure of health data

Individuals have rights to access their personal information and challenge its accuracy

Mandatory breach reporting to the Privacy Commissioner and affected individuals for breaches posing real risk of significant harm

Provincial health privacy laws (e.g., PHIPA in Ontario, HIA in Alberta) may impose additional requirements

Penalties up to CAD $100,000 for violations

🇦🇺

Privacy Act 1988 + My Health Records Act 2012

Australia

The Privacy Act 1988 and its Australian Privacy Principles (APPs) govern the handling of personal information by Australian Government agencies and private sector organisations. The My Health Records Act provides additional protections for electronic health records.

Health information is 'sensitive information' under the Privacy Act requiring heightened protection

Australian Privacy Principles (APPs) govern collection, use, disclosure, and security of health data

Notifiable Data Breaches (NDB) scheme requires notification to OAIC and affected individuals

My Health Records Act imposes strict controls on access to and use of My Health Record data

Individuals have rights to access and correct their health information

Penalties up to AUD $50 million for serious or repeated interferences with privacy

🌍

NDPR (Nigeria) + Kenya Data Protection Act 2019

Sub-Saharan Africa

The Nigeria Data Protection Regulation 2019 and Kenya's Data Protection Act 2019 represent the growing framework of data protection law across Sub-Saharan Africa, both drawing heavily from GDPR principles.

Health data classified as sensitive personal data requiring explicit consent

Data controllers must register with relevant authorities (NITDA in Nigeria; ODPC in Kenya)

Data subjects have rights to access, rectification, erasure, and objection

Mandatory breach notification requirements

Data localisation requirements may apply in certain circumstances

Penalties up to 2% of annual gross revenue or ₦10 million (Nigeria); up to KES 5 million (Kenya)

🇸🇬

PDPA — Personal Data Protection Act

Singapore and Thailand

Singapore's PDPA (2012, amended 2020) and Thailand's PDPA (2019) both establish comprehensive frameworks for personal data protection, with health data receiving special category treatment.

Health data is sensitive personal data requiring explicit consent or specific legal basis

Data Protection Officers (DPOs) required for organisations processing significant volumes of health data

Mandatory data breach notification to PDPC (Singapore) or PDPC (Thailand) within 72 hours

Data subjects have rights to access, correction, and withdrawal of consent

Penalties up to SGD $1 million (Singapore); up to THB 5 million (Thailand)

Cross-border data transfer restrictions apply

3. International Security Standards

ISO/IEC 27001:2022

International standard for Information Security Management Systems (ISMS). EchoReport's infrastructure and processes are designed in alignment with ISO 27001 controls for risk management, access control, cryptography, physical security, and incident management.

ISO 27799:2016

Health Informatics — Information security management in health using ISO/IEC 27002. Provides guidance on how to protect health information using ISO 27001 controls, specifically tailored for the healthcare sector.

HL7 FHIR

Health Level 7 Fast Healthcare Interoperability Resources. EchoReport's data structures are designed with future FHIR interoperability in mind, enabling potential integration with hospital information systems and electronic health records.

NIST Cybersecurity Framework

National Institute of Standards and Technology framework for improving critical infrastructure cybersecurity. Our security programme aligns with the NIST CSF's Identify, Protect, Detect, Respond, and Recover functions.

4. Patient Rights Summary

Regardless of your location, if your health data has been processed through EchoReport, you have the right to contact the healthcare practitioner who conducted your examination to:

Access a copy of your echocardiogram report

Request correction of any inaccurate information

Request deletion of your records (subject to medical retention laws)

Know who has accessed your health data

Withdraw consent for data processing

Lodge a complaint with the relevant data protection authority

Receive your data in a portable electronic format

Object to any processing of your health data

To exercise your rights directly with Synthera Luminary Group, contact us at synthera.apps@gmail.com. We will respond within the timeframe required by your applicable law.

5. Contact and Regulatory Authorities

Synthera Luminary Group — Data Protection Contact

Email: synthera.apps@gmail.com

Website: https://synthera.vip

You may also contact the relevant supervisory authority in your jurisdiction:

Jurisdiction	Authority	Website
South Africa	Information Regulator	inforegulator.org.za
European Union	Your national DPA (e.g., ICO for UK)	edpb.europa.eu
United States	HHS Office for Civil Rights	hhs.gov/ocr
Canada	Office of the Privacy Commissioner	priv.gc.ca
Australia	Office of the Australian Information Commissioner	oaic.gov.au
Nigeria	National Information Technology Development Agency (NITDA)	nitda.gov.ng
Kenya	Office of the Data Protection Commissioner	odpc.go.ke
Singapore	Personal Data Protection Commission	pdpc.gov.sg

This compliance statement is provided for informational purposes. It does not constitute legal advice. Practitioners should seek independent legal advice regarding their specific compliance obligations.