Trust, Security & Procurement
Everything your procurement team will ask — answered in advance.
We’ve sat on the buyer’s side of vendor onboarding. This page sets out Aprinove’s general contracting, security and data-handling posture so your legal, security and finance colleagues know what to expect.
1. Company information
Aprinove is a HealthTech transformation advisory founded and led by Amir Gilboa, working with healthcare organizations internationally. The advisory entity is registered in Israel.
Any remaining registration, address and insurance information is available on request as part of vendor onboarding.
Last reviewed: 8/2026
2. Security and data handling
Advisory engagements are designed to run on interviews, workflow observation and architecture-level documentation. Where document exchange is needed, we work inside the client’s own approved collaboration environment wherever possible.
Access control, device security, storage location, retention and permitted tooling — including any use of AI services — are agreed for each engagement before work begins, and are aligned to the client’s own information-security requirements.
Security questionnaires, architecture reviews and written descriptions of our data-handling practices are completed on request during onboarding.
3. Privacy and data protection
Aprinove designs advisory engagements to avoid access to patient-identifiable information wherever possible. When an engagement requires access to personal or health information, the applicable roles, safeguards, agreements, hosting, subprocessors, retention and security requirements are defined before work begins.
International data transfers. Cross-border data-transfer requirements are assessed according to the organizations, jurisdictions, systems and data involved. Appropriate contractual and technical safeguards are agreed before processing begins.
United States
Where an engagement involves protected health information, the required HIPAA roles, agreements and safeguards — including whether a Business Associate Agreement is required — are determined before access or processing begins. Aprinove does not claim HIPAA certification.
United Kingdom
Engagements are structured to fit UK GDPR and Data Protection Act requirements, along with the client’s own information-governance framework. Applicable data-protection roles and any required assessments are agreed at contracting.
European Union / EEA
Where personal data is involved, controller and processor roles, processing scope and safeguards are agreed under the GDPR before work begins. Israel holds a European Commission adequacy decision, which is one relevant transfer mechanism — it does not by itself make any given engagement GDPR compliant, so each engagement is assessed on its own facts.
International engagements
For other jurisdictions, applicable health-data, residency and procurement rules are identified during scoping, and the engagement is structured to meet them.
4. Contracting and invoicing
Contracting. Engagements are contracted directly with Aprinove. Where a client’s procurement rules require a local contracting entity or a local partner of record, raise it on the fit call and we will confirm what arrangement is workable before proposing.
Invoicing and tax. Invoicing currency is typically USD, EUR or GBP as preferred. Applicable tax treatment — including VAT treatment for business customers and any withholding requirements — is confirmed per engagement with your finance team.
Commercial structure. Diagnostic engagements such as the Opportunity Scan are fixed-scope, fixed-duration and fixed-fee. Delivery engagements are scoped individually.
5. Vendor documentation and references
Documentation required for vendor onboarding — company and registration details, insurance information, security and data-handling descriptions, data-protection agreements and client references — is provided on request as part of your process, typically within a few business days.
Requests: amir@aprinove.com.
Information on this page describes Aprinove’s general contracting and data-handling posture. Specific legal, privacy, security and tax requirements are agreed for each engagement.