Security
Last updated Sep 24, 2026
Millenary applies industry-standard technical and organisational measures to protect your personal data, proportionate to its sensitivity, particularly for the health data at the core of our Services.
Access controls
Access to systems holding personal data is role-based and limited to what is necessary for each person's role. Multi-factor authentication is required for all internal access, and access permissions are reviewed regularly.
Encryption
Data is encrypted at rest (AES-256) and in transit (TLS 1.2 or higher).
Hosting and infrastructure
Our platform is hosted by [hosting provider], within [the United Kingdom / European Economic Area]. Infrastructure is segmented so that databases and other sensitive components are not directly exposed to the public internet.
Vendor and subprocessor controls
All subcontractors that process personal data on our behalf are bound by data processing agreements requiring a level of protection equivalent to our own obligations. See our Subprocessors page for the current list.
Incident response
We maintain an incident response process to identify, contain and remediate security incidents, and to notify affected users and the relevant supervisory authority without undue delay where required by law.
Contact
Questions about this policy?
Write to operations@millenary.com and we'll get back to you.