Healthcare providers handle sensitive personal health information (PHI), medical records, and patient details. Protecting this information requires appropriate access controls, secure data handling, and safeguards for data storage and transfer.

Neurax Host offers hosting solutions for healthcare websites and applications. Before storing regulated health information, verify the selected service's security controls, data locations, contractual terms, and suitability for your healthcare workload.

Websites collect personal information through contact forms, customer accounts, bookings, and online transactions. Businesses must protect this information and follow the privacy laws that apply to their operations.

Review the Privacy Policy, Data Processing Agreement, and Security & Privacy Practices to understand the published policies and data processing responsibilities.

Depending on your location and activities, relevant requirements may include Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy laws, and the General Data Protection Regulation (GDPR).

Your organization remains responsible for determining which laws apply and managing its own privacy notices, access permissions, data retention, and incident response procedures.

Businesses that accept payment cards must understand the Payment Card Industry Data Security Standard (PCI DSS) requirements that apply to their payment environment.

Choosing a hosting provider does not automatically make an online store or payment application PCI DSS compliant. Requirements depend on the payment architecture, systems involved, validation method, and responsibilities of the business and its service providers.

Before selecting a plan, request applicable PCI DSS documentation and confirm your requirements with your payment processor or acquiring bank. You can also review the Neurax Host PCI Hosting page to assess the available service information.

ISO/IEC 27002 provides guidance on information security controls, including access management, asset protection, and incident response. Organizations can use this guidance to identify risks and improve their security practices.

Using security controls does not automatically establish ISO/IEC 27002 compliance or ISO/IEC 27001 certification. Businesses should review their own policies, processes, and evidence requirements.

Any claim about a provider's certification must be supported by a valid certificate covering the relevant legal entity and service scope.

The Cloud Security Alliance (CSA) STAR program provides information about cloud security practices and assurance. COBIT 5 is a framework for IT governance and management.

These frameworks serve different purposes. Registration, self-assessment, independent assessment, and framework implementation are not interchangeable.

Organizations evaluating Neurax Host should request relevant documentation to verify any claimed CSA STAR registration, assessment status, or framework implementation before relying on it for procurement or compliance decisions.

SOC 2 is an independent examination of a service organization's controls against applicable Trust Services Criteria. A Type II report evaluates the design and operating effectiveness of relevant controls over a defined period.

SOC 2 is an attestation report, not a general hosting certification. Coverage can vary by legal entity, service, controls, and reporting period.

Before relying on a report, verify the issuing auditor, covered organization, services, reporting period, and scope. Do not assume that a report covering one service automatically covers every hosting plan.

Contact Neurax Host to ask about applicable assurance documentation and its availability.