Built for the realities of healthcare security.

All data is encrypted at rest and in transit using enterprise-grade encryption. Data moving between the web server and the browser is secured with HTTPS, using RSA-encrypted TLS (Transport Layer Security).

Foxo has achieved HIPAA compliance, upholding transparency, security and privacy around users’ protected health and personal data. Foxo is also GDPR compliant: personal and sensitive information is carefully stored and managed.

Foxo is hosted on Microsoft Azure. All data is stored on secure servers local to your country, sovereign to the user’s location. The data centres conform to the ISO 27001 standard.

Australian deployments are hosted in Australia, on IRAP-certified infrastructure, and data is handled in line with the Australian Privacy Act.

U.S. deployments are hosted on isolated, compliant U.S. infrastructure.

Every Foxo user goes through mandatory verification to establish their identity before they can use the platform, so you know you are contacting the right person. Users join an organisation on request or through auto-join workflows, and administrators can remove and offboard them in the organisation’s settings.

Multi-factor authentication (MFA) is included at no extra cost, and mobile users can add a 4-digit PIN. Organisations can also sign users in through their existing identity provider with single sign-on (SSO), using SAML, Microsoft Entra ID or Okta, so access follows their own account policies.

Every quarter, Foxo engages an independent penetration tester to test the platform, cycling through different independent testers for the best results. This ensures vulnerabilities and threats are detected and addressed.

Foxo maintains 99.98% platform uptime.

Customer data is backed up at regular intervals throughout the day, with a complete backup every night. Database replication logs are kept for 30 days, so the database can be analysed and recovered to any point in that window.

Foxo meets the requirements of the Notifiable Data Breaches scheme under the Australian Privacy Act. If a breach affects your organisation’s data, we endeavour to notify you as quickly as possible.

Foxo meets the requirements of the HIPAA Breach Notification Rule. If a breach affects your organisation’s protected health information, we endeavour to notify you as quickly as possible.

Yes. Foxo keeps auditable activity logs, through a published ledger in the app with user-permission management. Foxo enables secure, accountable information transfer between healthcare providers under stringent data-sovereignty policies, and all activity is captured and logged.

Clinical images taken in the Foxo app are encrypted and stored on Foxo’s secure servers, not on the user’s mobile device or third-party cloud services such as Apple iCloud, Dropbox or Google Drive, so compliance with national privacy regulations is maintained.

Users can share any non-executable file. Foxo doesn’t limit file size, though the browser running Foxo may (for example, 256 MB).

The only personal (user) data Foxo actively collects from customers is what it needs to create profiles and administer accounts. Under Foxo’s terms of use, you keep ownership of the content you submit. All data is kept for a minimum of 10 years, encrypted in storage and in transit.

Patients can request a copy of their personally identifiable information (PII) and protected health information (PHI) at any time, and requests are actioned in a timely manner. Request information.

Yes. Foxo Technology Pty Ltd holds the WorkCover, cyber security, professional indemnity, and public and product liability insurance required for operating in state health departments.