Cloud hosting built for GDPR, HIPAA and NHS data
Secure, managed hosting for health and life-sciences applications and data, on AWS, Azure or on-premises, in the UK, EU or US.
Choose the compliance profile you need
Every plan is fully managed by Arithmia. Move up a tier as your regulatory requirements grow.
Secure Hosting
For digital health apps and data platforms handling personal data.
- Managed hosting on AWS, Azure or on-premises
- UK or EU data residency
- Encryption in transit and at rest
- Daily backups and disaster recovery
- 24/7 monitoring, patching and vulnerability management
- Controls aligned to UK/EU GDPR and Cyber Essentials Plus
Regulated Hosting
For NHS data and US health data under HIPAA.
Everything in Secure Hosting, plus:
- NHS DSPT-aligned controls and evidence
- HIPAA-ready US hosting on HIPAA-eligible services
- SSO, MFA and role-based access for all users
- Tamper-evident audit logging
- Tested restores and documented recovery objectives
- Compliance evidence pack for your assessors
Validated GxP Hosting
For pharma, CDMOs and medtech running GxP systems.
Everything in Regulated Hosting, plus:
- Validation to GAMP 5, EU Annex 11 and 21 CFR Part 11
- ALCOA+ data integrity controls
- Change control and validated releases
- Electronic records and signatures
- GxP Cloud Validation Pack, renewed annually
Security that's switched on from day one
Data residency
Host in UK, EU or US regions. Your data stays in the region you choose, and we document where it lives.
Encryption
Data encrypted in transit and at rest, with managed keys and documented key rotation.
Identity and access
Single sign-on, multi-factor authentication and least-privilege, role-based access.
Monitoring and patching
Round-the-clock monitoring, alerting, security patching and vulnerability management.
Backup and recovery
Automated backups, disaster recovery and restores that are tested, not assumed.
Audit and evidence
Audit logs and compliance evidence ready for DSPT submissions, HIPAA reviews and GxP inspections.
Your data stays where your regulator expects it
United Kingdom UK
For NHS and UK health data under UK GDPR and NHS DSPT.
AWS · Azure · On-premises
European Union EU
For EU personal data under EU GDPR, hosted in EU regions.
AWS · Azure · On-premises
United States US
For US health data under HIPAA, on HIPAA-eligible cloud services.
AWS · Azure · On-premises
Clear on who does what
Compliance in the cloud is shared. We document exactly which controls sit with the cloud provider, with Arithmia and with your organisation.
| Area | Cloud provider (AWS / Azure) | Arithmia | Your organisation |
|---|---|---|---|
| Physical data centre security | Cloud provider | — | — |
| Network, encryption and infrastructure setup | Shared | Arithmia | — |
| Patching, monitoring and backups | — | Arithmia | — |
| Identity and access control | — | Arithmia configures | You approve users |
| Validation documentation (GxP) | — | Arithmia prepares | You review and sign off |
| Lawful basis, DPIAs and data protection policies | — | Arithmia supports | You own |
Questions about hosting
Is your hosting HIPAA compliant?
We host US health data on HIPAA-eligible cloud services and implement the administrative, physical and technical safeguards HIPAA requires. HIPAA compliance is shared between the cloud provider, Arithmia and your organisation as the covered entity, and we document who is responsible for what.
Does hosting with you make us GDPR compliant?
Hosting is one part of GDPR. We provide the technical and organisational measures (residency, encryption, access control, logging and retention) and support your DPIAs. Your organisation remains the data controller.
Can you host in our own AWS or Azure account?
Yes. We can run the environment in your own cloud account, in ours, or on your premises.
How is hosting priced?
Each environment is quoted based on its size, region, compliance profile and support level. Many clients start with a readiness assessment to size it properly.
Is Arithmia certified?
Our own UK/EU GDPR, NHS DSPT, Cyber Essentials Plus, ISO 27001 and HIPAA programmes are in progress. We're happy to share our current position and controls during due diligence.
Get a hosting quote
Tell us about your application, data and regulatory needs. We will recommend a plan and region, and quote per environment.