Trust, security and compliance.
How we protect your data, govern AI and fit into your own medical, legal and regulatory approval process.
Built for regulated work.
Your approval stays final
Our review prepares content for your MLR process; it never replaces your sign-off.
Approved evidence only
Content and AI drafts are built only from references you provide or approve.
No patient data needed
Content work does not require patient-identifiable data, and we do not ask for it.
Full audit trail
Every draft, edit, comment and decision is recorded with who and when.
Data protection laws we work under
We work with clients in India and abroad, so each engagement follows the law that applies to it.
How we protect your information
Controls aligned to ISO/IEC 27001, applied to the platform and to our people.
Access control
Role-based access, single sign-on and multi-factor authentication; access reviewed and removed at project end.
Encryption
Data encrypted in transit and at rest on enterprise cloud infrastructure.
Data residency
India-region hosting by default for Indian clients; other regions on request.
Logging and monitoring
Access and activity logs retained and reviewed.
Backup and recovery
Regular backups with tested restoration.
Incident response
Defined response process, with client notification timelines agreed in contract.
People
Confidentiality agreements and security training for every team member and reviewer.
Deletion on exit
Client data returned or deleted at the end of an engagement, with confirmation.
Security documentation
Our certification status, security policies and completed questionnaires are shared under NDA during vendor qualification.
How we use AI responsibly
AI speeds up research and drafting on the MedOps platform. These rules decide how.
Grounded in your evidence
Drafts are generated only from your approved references; unsupported statements are flagged, not written.
Not used to train public models
Client content is processed through enterprise AI services and is not used to train public AI models.
Human approval required
No AI output is released without a qualified medical reviewer’s approval.
Traceable outputs
AI-assisted drafts are logged with their sources, so every statement can be traced.
Validated, documented processes
Records and audit trail are designed around the principles of 21 CFR Part 11 and EU GMP Annex 11, so they support your validation approach. Formal validation is scoped with clients who need it.
SOP-driven delivery
Writing, referencing, review and release follow documented standard operating procedures.
Controlled versions
Version control and change history for every asset, with reasons for each change.
Trained people
Training records for writers and reviewers, including your brand and SOP training.
Audit support
Documentation to support your vendor audits and computer system validation assessment.
Works with Veeva Vault PromoMats
We fit into the approval system you already use, rather than asking you to change it.
- MLR-ready packages: final asset, claim-to-reference annotations and our review history, prepared for upload to Vault PromoMats
- Fewer MLR rounds: our medical reviewer resolves issues before your committee sees the piece
- Direct integration: Vault API integration can be scoped for enterprise clients
- Other systems: the same packages work with other approval tools or your internal process
Veeva, Vault and PromoMats are trademarks of Veeva Systems Inc. InfocusRx is an independent service provider and is not affiliated with or endorsed by Veeva Systems.
Codes of practice we work to
- UCPMP 2024
- OPPI Code of Practice
- IFPMA Code of Practice
- Your internal SOPs
- FSSAI rules on claims (nutraceuticals)
- ASCI guidelines (consumer content)
Security and compliance FAQs
Are you ISO/IEC 27001 certified?
Our information security controls are aligned to ISO/IEC 27001. Our current certification status and security documentation are shared under NDA as part of vendor qualification.
Where is our data stored?
On enterprise cloud infrastructure in the region agreed with you. For Indian clients, India-region hosting is the default.
Do you use our content to train AI?
No. Client content is not used to train public AI models.
Can we audit you?
Yes. We support vendor audits and complete security and quality questionnaires.
Will you sign our NDA and data processing agreement?
Yes. We work under your NDA and DPA, or provide ours.
Does this work with Veeva Vault PromoMats?
Yes. We deliver annotated, MLR-ready packages with the metadata and channel formats your Vault PromoMats needs. A direct Vault API integration can be scoped for enterprise clients.
Need our security pack for vendor qualification?
We share policies, certification status and questionnaire answers under NDA.