Privacy Program for a Connected Medical Device Maker
Device telemetry, app data and patient consent governed under one privacy program that passed hospital and EU reviews.
Client name withheld by agreement- Client
- Connected medical device manufacturer
- Region
- Minneapolis, Minnesota and Ireland
- Year
- 2023
- Duration
- 14 weeks
- Scope
- 2 device lines · 1 companion app · 31 U.S. state laws and GDPR
- Practice
- Offensive Security & Resilience
The challenge
What was at stake.
A connected medical device manufacturer sells two device lines that stream readings to a companion app and a clinician portal. Device telemetry, app analytics and patient data were governed by three different teams with three different views of consent.
New U.S. state health-data laws, hospital procurement reviews and its EU operations in Ireland all asked the same question: what do you collect, why, and who can see it?
What we did
The approach, step by step.
- 01
Data mapped from device to cloud
We traced every data element from the device and app through the cloud platform, analytics tools and service partners.
- 02
Consent rebuilt in the app
Consent flows were redesigned to separate treatment data from analytics and marketing, with records that hold up under state law and GDPR.
- 03
Analytics vendors reviewed
Tracking SDKs in the app and portal were cut back, and the remaining vendors were bound by data processing terms.
- 04
Privacy reviews at design
Privacy impact assessments became a gate in the product development process, so new features are assessed before code is written.
Outcomes
What changed, in numbers.
- 31
- U.S. state laws and GDPR mapped to one program
- 14
- tracking SDKs removed from app and portal
- 100%
- of hospital privacy reviews passed
- 2
- device lines under a single consent model
Hospitals stopped sending us follow-up questionnaires. The first answer was enough.
Services delivered
Related engagements
More work in Offensive Security & Resilience.
-
Irving, Texas · 7 weeks
Offensive Security & Resilience · 2026Digital Ordering Penetration Test for a Restaurant FranchisorA loyalty-points fraud path worth millions closed before the national rewards relaunch.
-
Phoenix, Arizona · 18 weeks
Offensive Security & Resilience · 2025Ransomware Recovery Readiness for a Water AuthorityBilling, SCADA historians and plant engineering restored from clean copies in under 30 hours during a live drill.
-
Charlotte, North Carolina · 26 weeks
Offensive Security & Resilience · 2026 · OngoingUnified Controls and Audit Program for a Wealth-Tech Platform612 overlapping requirements folded into 148 owned controls, and one evidence cycle for four audits.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.