Compliance & Security

Trust should be designed in.

Security, quality, privacy and operational resilience are treated as design requirements from the beginning — with transparent boundaries around the standards we are pursuing and the controls we apply today.

Explore our posture ↓ Standards & frameworks
Transparency first Carmedin is working toward ISO 9001 and ISO/IEC 27001 certification. We do not represent those certifications as already achieved.
Trust & Resilience built into delivery
Quality &
Governance
Information
Security
Privacy &
Data Protection
Operational
Resilience
ISO 9001Certification program in progress
ISO/IEC 27001Certification program in progress
Least PrivilegeAccess aligned to need and sensitivity
Operational ResilienceContinuity considered from design onward
Our Security Posture

Four disciplines that reinforce every engagement.

Compliance is not a separate workstream added after implementation. These controls and operating principles are applied where they support safer, more dependable healthcare systems.

Quality & Governance

Structured processes that support consistency, traceability and controlled delivery.

  • Documented procedures
  • Change control
  • Traceable decisions
  • Continuous improvement

Information Security

Security controls matched to the sensitivity and operational importance of healthcare systems.

  • Identity & access
  • Least privilege
  • Secure configuration
  • Monitoring & logging

Privacy & Data Protection

Clinical and diagnostic information handled according to purpose, sensitivity and applicable obligations.

  • Data minimization
  • Access boundaries
  • Secure transfer
  • Jurisdiction awareness

Operational Resilience

Healthcare systems need recovery paths and support models that reflect clinical impact.

  • Backup & recovery
  • Business continuity
  • Incident response
  • Criticality-based support
Standards & Frameworks

Clear about where we are — and what applies.

We distinguish between certifications we are working toward, security principles we apply, and frameworks that become relevant because of a client's jurisdiction or healthcare context.

Important: Carmedin does not currently claim ISO 9001 or ISO/IEC 27001 certification. “Working toward” describes an active implementation program, not a completed certification.
ISO 9001
Quality management systemProcesses, documentation and continual improvement.
Working toward certification
ISO/IEC 27001
Information security managementRisk-based controls and management-system discipline.
Working toward certification
Lbp (Curaçao)
Landsverordening bescherming persoonsgegevensCuraçao's own data-protection law — the baseline we operate under.
Applies to our operations
GDPR / AVG
Privacy & data-protection principlesApplied where the Regulation is applicable to the relevant processing or engagement.
Context dependent
NEN 7510
Dutch healthcare information securityConsidered where work touches the Dutch healthcare context.
Context dependent
Built Into Delivery

Security follows the same lifecycle as the system.

The objective is to prevent a gap between implementation and operational reality. Controls, documentation and recovery thinking evolve with the engagement.

01 · UNDERSTAND

Risk & context

Clinical criticality, data sensitivity, architecture and applicable obligations.

02 · DESIGN

Controls by design

Access, segmentation, data flow, recovery and governance built into the architecture.

03 · IMPLEMENT

Controlled change

Configuration, validation, documentation and disciplined deployment.

04 · OPERATE

Monitor & improve

Support, observability, review, incident learning and continual improvement.

Service Level Agreements

Criticality determines the tier — not organization size.

A smaller healthcare organization can have systems that are just as time-sensitive as those in a large institution. Support levels should reflect operational impact.

Final coverage windows, escalation paths, exclusions and response commitments are defined contractually for each engagement.
Tier 1

Mission Critical

<4hTarget initial response

For systems where downtime directly affects patient care or diagnostic turnaround.

Tier 2

Professional

<8hTarget initial response

For core operational systems with high availability expectations.

Tier 3

Standard

NBDNext business day

For day-to-day systems where brief interruptions are tolerable.

Tier 4

Essential

2 DaysTarget initial response

For supporting systems and lower-urgency support requirements.

Procurement & Due Diligence

Need to evaluate our posture formally?

For procurement, tender or supplier-assurance processes, Carmedin can provide appropriate supporting information about its security, quality and operating practices, subject to confidentiality and engagement scope.

Discuss due diligence →
Security & quality documentationRelevant policies, procedures and control descriptions where appropriate.
Architecture & risk contextTechnical explanations that support evaluation of the proposed solution.
Transparent certification statusClear distinction between current controls and certifications still in progress.
Questions?

Evaluating Carmedin for a healthcare project or tender?

Tell us what your security, privacy or procurement process requires. We can clarify our posture and provide the appropriate level of detail.

Get in Touch →