Effective 5 April 2026 · Updated 5 April 2026
Role-based
Company-scoped
Least privilege
Counsel review
On this page
Averos Health is an occupational health screening platform. This page describes our general approach to protecting customer and workforce data.
It is not a formal certification (for example SOC 2 or ISO attestation). Deploying organizations remain responsible for their own policies, counsel review, and operational controls.
Access to admin, staff, and company portals is limited to authenticated users with appropriate roles.
Staff users only see sessions and employees assigned to their work.
Company portals are limited to that organization’s own workforce.
Employee, invite, session, and screening records are scoped to the relevant company.
Requests that attempt to access another organization’s data without authorization are denied.
Production deployments must use strong secrets and environment-based configuration. Secrets must not be committed to source control.
Public API responses are designed to avoid exposing passwords or unrelated tenant credentials.
Questionnaire answers, consultation notes, and prescriptions are stored in connection with the employee, session, and responding role.
Authorized administrators may review session progress from the Sessions console.
Prescription verification for pharmacies is available through a secure link associated with each prescription.
Portal routes require a valid session for the relevant user type.
Write paths validate inputs before storing or updating records.
Customers remain responsible for TLS, host hardening, backups, and staff device hygiene in their environments.
Keep production secrets secure and rotate them when appropriate.
Use HTTPS for all production portals.
Define retention and access-review policies for occupational health data.
Train staff on appropriate use of session review and prescription features.
Review Terms, Privacy, License, and this page with qualified counsel for your jurisdiction.
Legal notice. This document supports product and operator transparency. It does not constitute legal advice or a formal certification. Have qualified counsel review for your entity and jurisdiction.