Server alcove in a Swiss hospital, metal faces and coiled cable under cold hallway lighting
Security and encryption

Security and encryption of health data

Blood glucose and sensor data are health data. This page describes the schemes applied by Vitalink HealthData, points to check during a hospital security review, and the limits of what we can claim.

Contact the security team Consult API documentation
What this page covers

Three technical questions, and what they imply

Teams integrating glucometer or smartwatch data into an Electronic Health Record (EHR) always ask the same questions. Here is how we answer them, and what you need to be able to verify on your end.

In transit

Do measurements travel in plain text between the device, your application, and the EHR? No: channels are encrypted in both directions, for both reading and writing, and access tokens are never transmitted in plain text.

At rest

Where are blood glucose series and patient metadata stored, and in what form? Stored data is encrypted at rest, and keys are managed separately from the data itself.

Who accesses what

How to limit the scope of access when multiple systems and partners touch the same patient data? Rights are defined by role and resource, and this clarification is done before deployment.

Encryption in transit and encryption at rest

Two distinct layers

Encryption in transit

Exchanges between your application and the API pass through encrypted channels. This applies to both reading and writing resources: whether you are retrieving a series of measurements or writing a new observation, the transport is protected. OAuth tokens do not circulate in plain text. Encryption in transit protects data during transport; it says nothing about what happens once the data is written.

Point of vigilance: your side of the integration must also respect this contract. A client that caches measurements in plain text on a shared workstation cancels out part of the benefit.

Encryption at rest

Stored data is encrypted at rest. This concerns device measurements and associated patient metadata: linking identifiers, timestamps, device type. Keys are managed separately from the data, which prevents a backup copy from exposing both the content and the means to read it. This point is often requested during hospital security reviews.

Retention periods and deletion procedures are defined with you; we do not set them unilaterally.

Access control and traceability

One token per scope, one log per access

OAuth authentication

OAuth authentication allows for delegating access without sharing secrets between systems. Each client obtains a token linked to a scope: a cardiology department does not obtain the same rights as a diabetes department, even if both read the same types of resources. Tokens can be revoked, which replaces the exchange of passwords between departments—a practice that is difficult to audit and maintain.

Role-based access control

Access rights become a major integration point as soon as multiple systems and partners touch the same patient data. Vitalink applies scopes by role and resource: a client can only read or write what its role authorizes. These scopes must be thought through with your clinical architecture, starting from the conceptual phase—fixing them after production launch is costly in terms of review and reconfiguration.

Traceability and logging

Every access is logged: who, what, when. This traceability allows for answering hospital audit questions—a compliance department may ask who viewed a series of measurements over a given period. It also serves for diagnostics during an incident: when data seems missing on the EHR side, the log indicates whether the write was received, rejected, or never attempted. Logs are kept for a duration defined with you.

Legal scope

FADP and GDPR compliance

Processing falls under the Swiss Federal Act on Data Protection (FADP) and the European GDPR. This implies principles of minimization, purpose limitation, and data subject rights. This page describes the technical measures that support these principles; contractual details and legal bases are found in the privacy policy.

Read the privacy policy

Access rights and partners

When multiple partners touch the same data, rights become a governance issue. It is necessary to define who can read, write, and modify. Vitalink documents the available roles and their scope; clarification is done before deployment, not after.

Security of connected devices

A consumer glucometer or smartwatch does not offer the same guarantees as a certified medical device. Manufacturers vary in precision, measurement frequency, and how they expose their data. The API does not blindly trust the source: data is validated and normalized before being written to the EHR.

This point matters when you integrate various devices across a fleet: an implausible out-of-range value is flagged rather than written silently, and the device type remains attached to the measurement so the clinician knows where it came from.

Smartwatch placed on a hospital bed rail, low morning light

Consumer devices are accepted as a source, with validation and normalization before writing.

Security review and testing

Hospital integrations often go through a security review on the institution's side. Prepare your questions about keys, tokens, and logs: these are the three topics that come up most often. Vitalink provides the technical elements necessary for this review—flow diagrams, description of role scopes, access log formats.

We do not publish certifications that we do not hold. If a tender requires a specific attestation, tell us early: we will clearly indicate what is available and what is not, rather than leaving ambiguity in the response.

  • Key management: separation between data and the means to read it, rotation procedure to be defined with your teams.
  • Tokens: scopes by role, revocation, lifespan, and renewal conditions.
  • Logs: content kept, retention duration, read access for your compliance department.
Before the review

What is worth preparing

Flow mapping
Which systems send, which read, and through which scopes. A security review often starts with this map; having it ready speeds up the discussion.
Roles expected by department
Who should be able to read, who should be able to write, who should only see a subset. These decisions belong to your clinical governance, not the integrator.
Retention questions
How long logs and measurements must remain available, and according to what deletion rules. The answer varies from one institution to another.
The scope of your own risk analysis
This page describes the technical measures applied by Vitalink. It does not replace your risk analysis, which also covers your workstations, networks, and internal processes.

Frequently asked questions

The points that technical teams and compliance officers report to us most often.

Where is the health data processed by the API stored?

Data is stored on infrastructure that we operate on your behalf, with encryption at rest and keys managed separately. Exact locations and any subcontractors are listed in the privacy policy, as this information is part of your compliance analysis.

Can I revoke access without interrupting other integrations?

Yes. Tokens are linked to a client and a scope: revoking a token does not affect other clients or other roles. This is one of the benefits of the OAuth model compared to a secret shared between multiple services.

What does an access log contain, specifically?

A record identifies the client and the role involved, the targeted resource, the type of operation (read or write), and the timestamp. The exact format and retention period are aligned with the requirements of your compliance department, discussed before going into production.

How does a security review with an institution work?

We provide the requested technical elements—description of flows, role scopes, and logs—and answer questions from the institution's security department. The review remains driven by the hospital: it is their risk analysis, not ours.

Let's talk about your integration

If you are preparing for a security review or need to respond to a call for tenders, the technical team can detail the encryption schemes, role scopes, and log formats. For an initial discussion on pricing and the contractual framework, please visit the enterprise pricing page.

Request a technical demo Enterprise pricing
Contact us
Vitalink HealthData AG
Seefeldstrasse 45
8008 Zürich, Schweiz +41 21 581 78 71 [email protected] Monday – Friday: 09:00 – 18:00 (CET)