Security and compliance
ISO/IEC 27001 security approach
How Zoelio approaches information-security controls and communicates ISO readiness.
Page version 1.0 · Effective 2 September 2026
What this page means
This page describes Zoelio's security-management approach and readiness work. It is not a certification statement, audit opinion, or promise that every ISO/IEC 27001 control applies to every clinic.
Security controls in the product
Zoelio uses role-based access controls, tenant-scoped data access, authentication safeguards, audit trails, encrypted network transport, backups, and operational monitoring. Clinics remain responsible for their own users, devices, access assignments, retention choices, and local compliance obligations.
Risk and incident management
Security risks are reviewed through engineering, access, deployment, and incident-response processes. Material incidents are investigated, contained, documented, and followed by corrective action according to their scope and impact.
Supplier and access management
Service access is limited by role and operational need. Third-party services are evaluated for the data and function they handle, and access should be removed when it is no longer required.
Questions and evidence
Ask Zoelio for current security documentation before relying on a control or certification in your own assessment. Certification status can change only after an independent certification process; this page will be updated when verifiable status changes.