Clause-by-clause, framework-by-framework

Lawful basis / explicit consent

Voluntary participation; granular consent for personal results, aggregate inclusion, and EAP contact captured separately at provisioning.

Data minimization

On-device biometric processing; only derived numerical scores leave the device. No video upload or storage. Audit log records actor/category/scope, never individual scores.

Right to access / delete / portability

Self-service data export and deletion via account settings; tenant-level admin can request institution-scoped purge with provenance retained for 90 days.

Encryption in transit / at rest

TLS 1.3 in transit. AES-256 at rest via managed Supabase infrastructure. Per-tenant key separation on the roadmap.

Breach notification

Confirmed security incidents notified to Customer within 72 hours. Audit fix (2026-04-29): notification template + runbook are in_progress; status downgraded from "aligned" pending the documented runbook.

Data residency

Canadian-residency option via Canadian-region Supabase + storage. US and EU residency available on Enterprise tier. Per-tenant override at hospital level.

BAA / DPA / Acceptable Use Policy

DPA template available on request; AUP contractually prohibits performance / hiring / credentialing / discipline / underwriting use of GRW data. Audit fix (2026-04-29): HIPAA Business Associate Agreement template + Security Rule risk analysis are in_progress; HIPAA cell downgraded from "aligned" pending these artifacts and a signed BAA with Modal (the GPU sub-processor).

Audit log + access control

RBAC with 7 named roles, scope-bound role assignments, append-only audit log. RLS on every individual-data table. Subtraction-attack mitigation via tiered n-minimum (5 / 10 / 20).

Sub-processor disclosure

Sub-processor list maintained in the procurement bundle. Material changes require 30-day notice and right to terminate. Audit fix (2026-04-29): Modal (US GPU inference for large clips) is being added to /legal sub-processor list; status downgraded to in_progress for GDPR / HIPAA pending publication and the Modal Article 28 / BAA execution.

Vulnerability management / pentest

Annual third-party penetration test. SCA + SAST in CI on every PR. Critical CVEs patched within 7 days; high CVEs within 30.

SOC 2 Type II attestation

In progress with external auditor. Attestation letter shared in procurement bundle on request.

HITRUST certification

CSF v11 controls inventory mapped; certification scheduled post-SOC 2.

Right to object / opt-out (automated decision-making)

GRW does not perform individual-level automated decisions affecting employment, benefits, or care. AUP contractually prohibits such use by Customer.