generated: '2026-07-19'
method: searched
source: https://glooko.com/trust-privacy/
docs:
- https://glooko.com/partners/
- https://developers.glooko.com/
notes: >-
  Conformance asserted from Glooko's public trust/privacy page and partner
  integration pages. Glooko exposes a partner-gated API and EHR integration
  program (developers.glooko.com); no public self-serve OpenAPI is published, so
  security-scheme evidence below is from documented integration model (SMART on
  FHIR) rather than a machine-readable spec.
standards:
- id: smart-on-fhir
  conforms: true
  evidence: >-
    Glooko documents "seamless interoperability via SMART on FHIR with major EHR
    systems" for its EHR integration program.
- id: fhir
  conforms: true
  evidence: EHR interoperability delivered over HL7 FHIR via SMART on FHIR.
- id: oauth2
  conforms: true
  evidence: >-
    SMART on FHIR authorization is built on OAuth 2.0 authorization-code flow for
    EHR-launched and standalone apps.
- id: hipaa
  conforms: true
  evidence: HIPAA compliance maintained via HITRUST r2 certification (trust-privacy page).
- id: soc2-type2
  conforms: true
  evidence: SOC 2 Type II and SOC 3 attestations listed on the trust/privacy page.
- id: iso-27001
  conforms: true
  evidence: ISO 27001 certification (3-year, TUV audit) listed on the trust/privacy page.
- id: hitrust-r2
  conforms: true
  evidence: HITRUST Risk-based 2-year (r2) Certification listed on the trust/privacy page.
- id: gdpr
  conforms: true
  evidence: GDPR compliance managed via the OneTrust platform (trust/privacy page).
- id: ccpa
  conforms: true
  evidence: CCPA compliance managed via OneTrust (trust/privacy page).
- id: lgpd
  conforms: true
  evidence: LGPD compliance managed via OneTrust (trust/privacy page).
- id: nhs-dspt
  conforms: true
  evidence: NHS Data Security and Protection Toolkit (UK) referenced on the trust/privacy page.
- id: ce-mark
  conforms: true
  evidence: CE mark for Glooko XT (France) referenced on the trust/privacy page.
- id: rfc9457-problem-details
  conforms: false
  evidence: No public OpenAPI available to confirm application/problem+json error format.