Security, privacy & accessibility — verified, not just claimed.
Many platforms claim compliance. ExpiWell’s HIPAA and GDPR controls are monitored continuously, with a live trust report anyone can open — and trusted by IRBs in medical and clinical settings.
Checked continuously. Trusted by IRBs.
Every claim on this page points to something you can open — a live control monitor, a signed agreement, a published statement. That’s the standard your IRB holds you to — so it’s the standard we hold ourselves to.
HIPAA Compliant
Platform security and privacy complies with HIPAA and is used routinely for research capturing Protected Health Information. Every aspect of compliance is reported in real time.
Monitored continuously via Vanta ››GDPR Compliant
Aligned to the requirements of EU and UK customers, with appointed EU and UK GDPR representatives and separate EU data residency.
EU & UK representatives appointed ››Web Accessibility
We adhere to W3C WCAG 2.1 guidelines at the AA level — so every participant can access the platform and share their experiences, whatever their abilities.
Partnered with accessiBe ››SOC 2 is underway. We’re working toward certification — once it’s independently verified, it will be listed here alongside the others, with its report linked.
Your participants’ data, where it belongs
The GDPR posture in one place: separate EU infrastructure, appointed representatives in both the EU and the UK, and the data-subject rights every study has to be able to honor.
- Separate US and EU deployments for GDPR data residency
- EU resident data stays in the EU region
- Appointed EU and UK GDPR representatives
- Data-subject rights — access, correction, and erasure — set out in the GDPR policy
- Signed Business Associate Agreements (BAA) available
- Consent management built into every study
- We help walk your team through the IRB process
- Cookie consent on our website in accordance with GDPR
How we keep EMA and ESM data secure
Nine controls, three layers — covering the data itself, the people who touch it, and the systems it runs on.
Data protection
People
Systems & recovery
Don’t take our word for it — read the reports
Compliance is checked continuously. These documents are the same ones we hand to IRBs and university security reviews.
Trust report
Real-time compliance status for every monitored control, hosted by Vanta.
GDPR policy
How we meet EU and UK data protection requirements, including your rights as a data subject.
Privacy statement
What we collect, why we collect it, and how long we keep it — in plain language.
Accessibility statement
Our WCAG 2.1 AA conformance status and remediation commitments, via accessiBe.
Elevate your research
Join over 7,000 researchers around the world and start collecting high-fidelity data today.