Compliance and standards
Veona is built for African healthcare, governed by the law of the market it serves and engineered to recognised clinical standards. Here is where we stand, stated plainly.
Local law, local accountability
Patient data is processed under each facility, which is the data controller. Veona acts on documented instructions and aligns to the data-protection regime of the country where the deployment operates.
Nigeria
NDPA 2023 and NDPRRegulator: Nigeria Data Protection Commission (NDPC)
We align to the Nigeria Data Protection Act 2023 and the NDPR, support registration with the NDPC, and appoint a Data Protection Officer (DPO) as required.
Kenya
Data Protection Act 2019Regulator: Office of the Data Protection Commissioner (ODPC)
We align to Kenya’s Data Protection Act 2019 and the supervisory role of the ODPC for deployments serving Kenyan facilities.
Ghana
Data Protection Act 2012 (Act 843)Regulator: Data Protection Commission
We align to Ghana’s Data Protection Act 2012 (Act 843) for the lawful processing of personal and health data.
South Africa
POPIARegulator: Information Regulator
We align to the Protection of Personal Information Act (POPIA) and its conditions for lawful processing.
African Union
Malabo ConventionRegulator: African Union
We track the AU Convention on Cyber Security and Personal Data Protection (Malabo Convention) as the regional framework for data protection.
Standards we build to
These standards are reflected in how Veona codes, exchanges, and assures clinical and laboratory data.
Quality and competence for medical laboratories. Our laboratory and diagnostics suite is built to this lab-quality standard.
International Classification of Diseases for consistent clinical coding and reporting.
Export to national health information systems for public-health reporting.
Modern interoperability for exchanging clinical resources with other systems.
Established messaging for orders, results, and clinical events across hospital systems.
Imaging interoperability for radiology and PACS.
Targets, stated honestly
The following are published trust milestones we are working toward. They are targets, not certifications we currently hold. We will update this page if and when status changes.
ISO 27001
Target / in progressInformation security management. A published milestone we are working toward. Not currently held.
SOC 2
Target / in progressTrust services controls for security and availability. A published milestone we are working toward. Not currently held.