Compliance & Standards

The Gateway is engineered around privacy-by-design: role-isolated portals, sealed quotes enforced at the data layer, masked identity before award, staged result release, immutable audit logging and mandatory two-factor authentication for privileged operations. Compliance is shared — the platform provides the controls; Customers and Providers are responsible for the approvals and licences their own work requires.

For users and counterparties in the EU/UK, we operate as follows:

• Lawful bases mapped per processing activity (Privacy Policy §4): contract performance, legal obligation, legitimate interests, and consent where required.
• Special-category data (genetic, health — Art. 9) handled under documented instructions, de-identified where possible, under heightened access controls; we require Customers to establish the Article 9 condition.
• Data subject rights honoured within one month — access, rectification, erasure, portability, restriction, objection (Privacy Policy §9).
• Transfers outside the EU/UK via adequacy decisions or Standard Contractual Clauses.
• DPA available — a Data Processing Agreement for Customers for whom we act as processor; a DPIA can be supported on request for high-risk processing.
• Breach notification to supervisory authorities and affected parties within required timelines.

The Gateway is not a HIPAA covered entity or business associate by default — we do not host raw genomic or clinical datasets, and project attachments are documents only. For HIPAA-covered customers (US providers, payers or clearinghouses):

• upload only data de-identified consistent with 45 C.F.R. §164.514 — Safe Harbor removal or Expert Determination;
• your organisation remains responsible for its own PHI handling and minimum-necessary rules;
• where a genuine business-associate relationship is required, contact us — a Business Associate Agreement may be executed for qualifying engagements.

• ISO 15189 — medical laboratory competence; where a provider holds accreditation it is declared on its registry profile and verified during onboarding.
• ISO/IEC 17025 — testing and calibration laboratories; competence claims are shown per provider.
• GLP / GCP — for regulated studies (preclinical, clinical-trial support), customers and providers contract for the applicable Good Practice framework; project records support audit trails.
• Good Documentation Practice — QC verdicts, stage history, file releases and decisions are preserved as tamper-evident project records.

Provider accreditations are provider-declared and Syntax-verified to our criteria; Customers remain responsible for confirming the accreditation level their study requires (see Terms §4).

Security controls are aligned with ISO/IEC 27001 and ISO/IEC 27701 principles: encryption in transit and at rest, least-privilege access, TOTP second-factor enforcement for privileged roles, database-enforced quote isolation, audit logging, and periodic review. Vulnerability disclosures are welcome via contact — responsible reporting is appreciated.

• PECA 2016 — electronic transactions and cyber-crime provisions applicable to platform conduct.
• Personal Data Protection Bill — Pakistan's draft data-protection framework; our controller/processor architecture and rights handling are designed in anticipation of its requirements.
• National Biosafety Committee / Pakistan Biosafety Rules — governing GMO and regulated-organism work; providers must hold the approvals their scope requires.
• DRAP — Drug Regulatory Authority of Pakistan rules where supplies or diagnostics fall within its remit.
• Company & tax law — invoicing, retention and reporting per applicable Pakistan statute.

Counterparties elsewhere (for example under Canada's PIPEDA or Australian Privacy Act) are handled under the equivalent principles in our Privacy Policy — documented instructions, safeguards, and contractual commitments. Where a project must satisfy a specific framework, raise it during RFQ scoping so routing can match appropriately accredited providers.

Customers and providers may request: our DPA template, security questionnaire responses, verification criteria summaries, and (for their own engagements) the provider documentation referenced in Section 4. Route all compliance requests through contact.