Your standard, applied to your own deployment.
Dutch care providers have to work to NEN 7510, and buyers expect their suppliers to show it too. Open Wearables runs inside your own environment, under your controls.
Why it runs in your cloud
The layer has to be yours before what you build on it can be.
A hosted API keeps the data, and every score computed from it, in a vendor's account. Running the layer yourself keeps it where HIPAA, GDPR and your own policy say it belongs.
Sovereignty
Your regulator, your board or your own policy says health data does not sit in a third party's cloud.
Residency
The data has to stay in a country or region you choose, and you have to prove where it is.
Control
You run the deployment under your own credentials and decide who gets access. What you build on top of Open Wearables is yours.
Your own reasons
No regulator forcing it and no security review coming. You want the data in your own account anyway.
The short answer.
Required for care providers.
Rules on electronic processing require care providers to work to NEN 7510. Certification is optional, but buyers ask.
It reaches suppliers.
Care organisations show the standard reaches their supply chain, which is where a hosted API becomes a separate review.
Self-hosting keeps one perimeter.
Open Wearables runs in your own environment, under the network rules, logging and policies you already have in place.
No vendor tenant in the path.
Self-hosted, the data goes from the provider or the phone straight into your own account, in the region you chose.
Where it sits is yours.
Dutch hosting, another EU region or your own servers. The standard is about controls, and you choose the location.
The detail
Three ways to build it.
What your buyer assesses under each approach, when the standard has to reach your suppliers.
| Hosted wearable API | Build it in-house | Open Wearables, self-hosted | |
|---|---|---|---|
| [01] What your buyer assesses | Your controls and the vendor's | Your controls | Your controls |
| [02] Assessments to run | Two, one of which you do not run | One | One |
| [03] The integrations | Written by the vendor | Yours to write and maintain | Already written, MIT licensed |
| [04] What it takes | A supplier to assess | Integration work and ongoing maintenance | A deployment in your own account |
How it works in practice.
The question is settled when the deployment is set up, not negotiated afterwards.
Your environment
Network rules, infrastructure logging and backups are the ones your environment already runs, not a second set.
The host and the region
Azure and Google Cloud both run regions in the Netherlands, and EU regions or your own servers work too.
Credentials in your name
Provider credentials are issued to you, so the relationship with each wearable provider is yours.
Moving later
Where we set it up, the infrastructure is code in your repository, so a region change is engineering work.
The data path
Where the data goes, step by step.
Every step runs inside your deployment, in the region you chose. Nothing passes through a Momentum tenant on the way.
- 01
Collect
Cloud providers connect server to server, and the mobile SDKs read the stores that live on the phone. Every source ends up in the same deployment, in your account.
- 02
Store
Everything lands in one schema in your own database, in your Dutch region, with the original payload kept underneath if you switch that on.
- 03
Compute
With Pro, health scores from our science team, computed inside your deployment.
- 04
Use
Your product reads it over the REST API, reacts to webhooks, or asks questions through the MCP server, all against the same deployment.
Tell us what you are building
We will tell you what it takes to run it inside your own environment.
FAQ
Common questions.
Is NEN 7510 legally required?
For care providers, working to it is: the rules on electronic data processing in care point to NEN 7510 and two related standards. Certification is not required by law, but insurers and enterprise buyers often ask for it.
Are you certified to it?
No. The standard applies to the organisation handling health data. Self-hosted, our software runs inside your environment and under your controls, rather than beside them.
Our customer asks whether our suppliers meet the standard. What do we say?
That the wearable data layer runs inside your own environment rather than a supplier's, so it falls under the controls you already documented. That is usually a shorter answer than assessing a vendor.
Does the data have to stay in the Netherlands?
The standard is about security controls rather than location, and EU hosting is common. Where your contracts or customers require Dutch hosting, choose a Dutch region, and the deployment goes there.
How is this different from ISO 27001?
NEN 7510 builds on ISO 27001 with healthcare-specific requirements. The deployment sits inside whichever of the two you run.
Do you give legal advice?
No. We tell you what the architecture does. Whether a requirement reaches your product is for your counsel.