Security & Compliance
GDPR · HIPAA · FHIR
Standards ROOK works with
- GDPR
- HIPAA
- FHIR
ROOK operates under a HIPAA-aligned security program, signs BAAs with covered entities, and processes EU personal data under GDPR as a data processor.
Standards
The standards behind every ROOK integration.
ROOK operates under a HIPAA-aligned security program, signs BAAs with covered entities, and processes EU personal data under GDPR as a data processor.
GDPRGeneral Data Protection Regulation
- EU & EEA
- Personal data
- Privacy
The EU regulation on how personal data is collected, processed and stored. ROOK processes EU personal data under GDPR as a data processor.
Talk to our team
HIPAAHealth Insurance Portability and Accountability Act
- United States
- Health information
- BAA available
The US standard for protecting health information. ROOK operates under a HIPAA-aligned security program and signs BAAs with covered entities.
Request a BAA
FHIRFast Healthcare Interoperability Resources
- HL7 standard
- Interoperability
- R4 output
The HL7 standard for exchanging healthcare data between systems. ROOK supports FHIR-based interoperability for clinical-data workflows, with FHIR R4 output for lab data.
Explore Lab Data API
Talk to our team
ROOK is categorized as "Medical testing services, namely, fitness evaluation".
Safeguards
Four safeguards protect the data ROOK handles.
Each card shows its safeguard at work on a sample record.
Pseudonymized data
UUID-based architecture
- UUID-based
- Less identifiable
ROOK uses a UUID-based architecture to pseudonymize user data, reducing direct identifiability and minimizing exposure.
Data encryption
At rest and in transit
- At rest
- In transit
Protected data is encrypted both at rest and in transit, so it stays unreadable to anyone without access.
Access controls
Least privilege, need-to-know
- Role-based
- Least privilege
Role-based access controls let only authorized users reach protected data, following least privilege and need-to-know principles.
Cloud infrastructure
Multi-layered security
- Scalable
- Multi-layered
ROOK runs on a secure, scalable cloud infrastructure with multi-layered security protocols around the data.
For your review
Every document your compliance review asks for.
Agreements and policies your legal and security teams can check before you integrate. ROOK's API is also designed to support CCPA and CPRA requirements.
Business Associate Agreement
HIPAA
- United States
- Health information
- BAA available
For implementations that handle protected health information. ROOK signs BAAs with covered entities as part of the implementation.
Request a BAAData Processing Agreement
GDPR
- EU & EEA
- Personal data
- DPA available
For processing personal data under GDPR. ROOK supports it with a Data Processing Agreement.
Request a DPAPrivacy policy
Last updated May 28, 2026
- Policy
- 13 sections
What personal data ROOK collects, and how it is processed and disclosed.
Read the policyTerms for ROOK services
Last updated August 2026
Cookies policy
Last updated June 3, 2026
Articles on compliance from the ROOK blog
- What Are the Challenges of Using Wearable Data in Insurance?Insurers using wearable data must handle accuracy gaps, inconsistent formats, privacy, legacy integration and consent. Strategies to address each challenge.Read more
- Should you build wearable data integration in-house or buy it?Compare building wearable data integration in-house with using a third-party platform like ROOK, including the insurance use case and the ThyForLife case.Read more
- What are the hidden costs of fragmented wearable data?Fragmented wearable data costs retention, operations, insights and compliance effort. AI-assisted standardization can unify the streams.Read more
Nothing matches that search.
Compliance
Start building on secure health data.
Talk to our team about BAAs, DPAs and the security documentation your review needs.
FAQ
Frequently asked questions about ROOK compliance
The standards, safeguards and agreements behind every ROOK integration.
Which compliance standards does ROOK follow?
ROOK operates under a HIPAA-aligned security program, signs BAAs with covered entities, and processes EU personal data under GDPR as a data processor. ROOK’s API is also designed to support CCPA and CPRA requirements.
Does ROOK sign a Business Associate Agreement?
Yes. For implementations that handle protected health information, ROOK signs BAAs with covered entities as part of the implementation.
Does ROOK offer a Data Processing Agreement?
Yes. For processing personal data under GDPR, ROOK supports it with a Data Processing Agreement.
How does ROOK protect the data it handles?
ROOK uses a UUID-based architecture to pseudonymize user data, encrypts protected data at rest and in transit, applies role-based access controls following least privilege and need-to-know principles, and runs on a secure, scalable cloud infrastructure with multi-layered security protocols.
Which documents can my team review before integrating?
The Business Associate Agreement, the Data Processing Agreement, the privacy policy, the terms for ROOK services and the cookies policy.
No questions match that yet. Try another word or topic.
Still have questions?Our team can review your sources and use case with you.
Schedule a demo