BlueWhale Stack lets hospitals, insurers, CROs and digital-health companies run clinical, research and patient-facing systems across cloud and on-prem on the Enterprise Edition — with patient data pinned to an in-country region, access federated from the hospital directory, change control with an audit trail, and an air-gapped option for networks behind strict firewalls. Available today.
- In-region
- Patient data pinned to Mumbai or Frankfurt
- Air-gapped
- Option for isolated clinical networks
- SCIM
- Access follows the hospital directory
- P0–P4
- Change control with SLAs and audit trail
The regimes, and the control that answers each
| Regime | What it demands | The control that answers it |
|---|---|---|
| DPDP Act 2023 / GDPR | Patient data localised, processing purpose-limited and evidenced | Residency pinned to Mumbai or Frankfurt; access and processing written to the audit trail |
| Clinical change control | Every production change approved, tracked and reviewable | ITSM change records with P0–P4 SLAs and a full audit trail |
| Workforce access hygiene | Clinicians, researchers and contractors get exactly the access their role needs, revoked on exit | IdP federation with SCIM provisioning; roles scoped by department and system |
| Availability of clinical systems | Degradation detected and escalated before it reaches the ward | Observe SLOs with burn-rate alerts; incidents opened automatically in ITSM |
What Healthcare teams get
- Pin workloads, inventory records and audit entries to Mumbai (DPDP) or Frankfurt (GDPR), so localisation is a platform setting rather than a process
- Deploy air-gapped for isolated clinical networks, with signed offline updates and no call-home
- Federate the hospital directory over SAML/OIDC with SCIM provisioning, so clinicians and researchers get the right role on first login and lose it on the next sync
- See clinical, research and administrative estates — cloud and on-prem — in one inventory grouped by system
- Track every production change through ITSM with P0–P4 SLAs and keep the record for auditors
Use cases
Patient data residency & in-region storage
Pin workloads, inventory and audit records to an in-country region — Mumbai for DPDP, Frankfurt for GDPR — with air-gapped deployment available for networks behind strict firewalls. Modules: Inventory & Discovery, Identity & Access.
Federated access for clinical & research staff
Federate your IdP with SCIM provisioning so a new hire is granted the right role on first login and offboarded automatically on the next directory sync. Modules: Identity & Access.
Change control with audit evidence
Every production change is tracked through ITSM with P0–P4 SLAs and breach detection, with a full record retained for auditors. Modules: Whale ITSM, Inventory & Discovery.
Bundled observability for clinical systems
Observe gives logs, metrics, traces and SLOs in one place, raising incidents automatically when a critical system degrades. Modules: Observe, Whale ITSM.
Procurement, hosting and integration questions
Can research data and clinical data be governed separately?
Yes. Workloads are grouped by system, roles are scoped per workload, and residency and access policies apply per group — so research collaborators never inherit clinical access.
Do you support hospital networks that cannot connect outbound?
Yes — the air-gapped deployment class runs with no outbound connectivity and receives signed offline update bundles; the Edge Agent inventories the estate inside the network.
Which certifications does the platform hold?
ISO/IEC 27001, 27017, 27018 (PII in the cloud), 27701 (privacy) and ISO 22301, independently audited, plus a GDPR compliance assessment — certificates are in the Trust Center.
Platform certifications
ISO/IEC 27001:2022, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27701 and ISO 22301, independently audited by accredited bodies; a CSA STAR Level 1 self-assessment, a GDPR compliance assessment and a SOC 2 Type II readiness assessment. Certificates and verification numbers are in the Trust Center.