For EU telehealth and healthcare platform builders, choosing a video API under GDPR comes down to one question: can the vendor keep patient data under European data protection law from the first packet to the stored recording?
The options we cover are Digital Samba, Whereby Embedded, Pexip, Daily, Vonage Video API, Twilio Video and LiveKit. Digital Samba, Whereby Embedded and Pexip are European. Daily, Vonage, Twilio and LiveKit are US-based. Whereby, Daily, Vonage, Twilio and LiveKit will all sign a Business Associate Agreement (BAA) under the US Health Insurance Portability and Accountability Act (HIPAA) for US-facing work, and each entry below says how.
Digital Samba is our product, so we have listed it first and judged every vendor, ourselves included, on its own public documentation.
Table of contents
This guide is about the healthcare-specific decision. For the general rules on what makes any video API GDPR-compliant (EU hosting, a Data Processing Agreement, sub-processors, end-to-end encryption and white-label control), see our guide to GDPR-compliant video conferencing. Here we focus on what changes when the people on the call are patients and the data is medical. We cover embedded video APIs and SDKs that you build into your own product. Meetings-first platforms such as Zoom or Microsoft Teams also offer healthcare plans with a BAA, but you adopt their application rather than embed video in your own, so they sit outside this comparison.
Health data is special-category data under GDPR Article 9, which sets a higher bar than ordinary personal data. A video consultation can expose a diagnosis, a mental-health condition or a medication list, so the video layer inside a telehealth or remote-patient-monitoring app processes highly sensitive data. That raises the stakes on four things a general video API comparison tends to gloss over:
Use these criteria to score any video API for a telehealth or healthcare build. They sit on top of the general GDPR checklist, not instead of it.
Confirm in writing where live media, recordings, chat and metadata are processed and stored. For EU health data the safest answer is EU/EEA-only, documented in the Data Processing Agreement and sub-processor list. Residency is only half the question: a video API run by a US-headquartered company can still fall under US lawful-access law such as the CLOUD Act, which lets US authorities require US providers to hand over data in their control wherever it is stored, even when media is pinned to an EU region, so EU data residency on a US-controlled provider is not the same thing as EU jurisdiction (GDPR and the US CLOUD Act).
Some European providers host on infrastructure certified specifically for health data, such as France's HDS (Hébergeur de Données de Santé) or the Dutch NEN 7510 standard. These are hosting-layer credentials, so always check whether they cover the vendor's own deployment. GDPR is the baseline, but national rules can add to it: in Germany, for example, doctors billing statutory health insurance for video consultations must use a video service certified under Annex 31b of the national contract for statutory-insurance doctors, the BMV-Ä (GKV-Spitzenverband).
Transport encryption protects data in motion, but end-to-end encryption (E2EE) means even the vendor's servers only ever see ciphertext. For one-to-one and small-group consultations this is the strongest confidentiality guarantee. The trade-off is that no server can process the media, so server-side transcription and captions are off, and a server-side recording needs E2EE to be paused while it runs. On Digital Samba, for example, starting a recording suspends E2EE, and the call stays encrypted in transit. E2EE is also chosen when the room is created, so decide up front, per room or consultation type, whether the consultation needs to be recorded.
The call should render inside your own app, under your brand, beside the patient record. Check for an API and SDK that let you control the interface, not just a brandable widget.
Look for clean integration into electronic health record (EHR/EMR) systems, scheduling and billing through APIs, SDKs and webhooks, so a consultation can be launched from the patient record and logged back to it.
Waiting rooms, in-session roles (who can admit a patient, who can share), and controls over recording and retention keep the right people in the room and make sure medical records are handled properly. Patients should also know about, and agree to, any recording before a consultation is recorded.
Consultations are booked appointments, so check documented availability commitments, EU-based support and the maturity of the platform before it carries real patient care.
HIPAA is a US framework. It applies to US covered entities and their business associates, so if your organisation or your customers fall into either group, you will need a vendor that signs a BAA. If your patients and regulators are in the EU, GDPR plus EU residency is the baseline that matters, and HIPAA is not required.
Whichever vendor you choose, it covers the processing layer only. As the controller, your platform still needs its own lawful basis and an Article 9 condition for health data, a Data Protection Impact Assessment (DPIA) for large-scale processing, and clear patient information. Video used only to communicate is generally not a medical device, but monitoring or diagnostic features built around it can bring your product under the EU Medical Device Regulation (MDR); the Commission's MDCG 2019-11 guidance explains how software is assessed.
We compared each vendor on the points where they differ most for a healthcare build: EU residency, health-data hosting, white-label embedding, HIPAA and deployment model. Facts are drawn from each vendor's own public documentation as of October 2026, and for Digital Samba also from our security white paper. Verify the specifics under your own DPA or BAA.
Digital Samba is our embedded video conferencing API and SDK, built by a Barcelona-based company registered in Spain. On our standard EU platform, media, recordings and session data stay on EU infrastructure: production runs on Leaseweb in Amsterdam and Scaleway in France, the Netherlands and Poland, with backup in Frankfurt, and no application data is stored outside the EU/EEA (security white paper, section 9.4). Scaleway holds HDS certification, and Leaseweb holds a third-party statement of alignment with NEN 7510 (an assessment, not a certification). If you need HDS-certified hosting, talk to us about deployment options.
Our platform is fully white-label and embeds inside your own clinical app through a REST API and SDK, with waiting rooms and in-session roles for patient privacy. End-to-end encryption is optional. When it is on, keys change whenever someone joins or leaves, so a newcomer cannot decrypt what came before and a departed participant cannot decrypt what comes after, and the media servers only see ciphertext. Besides the managed EU platform, we offer an on-premises deployment, where you run the platform on your own infrastructure. We also offer a standard DPA, which includes a professional-secrecy clause for customers such as doctors bound by medical confidentiality.
Integration with your EHR, scheduling and billing is built by your team on our REST API, embedded SDK and webhooks, rather than through a ready-made connector. Because the product is designed for embedding, teams that want direct control of the media stack may be better served by a lower-level programmable API. On HIPAA, our EU infrastructure is not run under a BAA. Customers subject to HIPAA have two routes: US-based infrastructure from us on a HIPAA-eligible provider, or an on-premises deployment with a BAA signed with their own infrastructure provider.
Whereby Embedded is an embedded video API and SDK from a Norway-based company. Norway is in the EEA, where GDPR applies in full. Whereby is widely used in telehealth and markets itself on compliance: the video API is ISO 27001-certified and GDPR-compliant, and Whereby documents a standard BAA and a HIPAA-compliant setup, with rooms configured for HIPAA during integration (Whereby HIPAA announcement). End-to-end encryption applies to small rooms only; larger rooms are decrypted and re-encrypted for routing (Whereby security documentation).
For EU-only residency, check where media and recordings are handled. Whereby's documentation says user account data is stored in Ireland (EU), but it does not state EU-only hosting for media and recordings, so get EU residency written into the contract if you need it. Whereby runs primarily on Amazon Web Services, so the CLOUD Act point under criterion 1 applies to its hosting provider as well.
Pexip is an enterprise video platform, also Norway-based, with a strong data-control offering for regulated sectors. It is a platform rather than a drop-in API, but we include it because its self-hosted option matters to healthcare teams that need to keep data on their own infrastructure. Pexip offers self-hosted (Pexip Infinity), private-cloud and managed deployment options, which let a healthcare organisation keep patient data in infrastructure it controls. It describes its platform as enabling HIPAA compliance (Pexip security and data protection). It also offers a healthcare integration that lets patients launch calls from Epic MyChart (Pexip healthcare for Epic).
Pexip is built for large organisations and takes more work to deploy than a typical API, and the self-hosted path means you run and secure the infrastructure yourself. Pexip's public materials do not mention BAAs, so confirm BAA availability and the data-centre locations for any Pexip-hosted option.
Daily is a US-based embedded video API and SDK, popular with developers for fast integration. It is SOC 2 Type II certified and covered by the EU-US Data Privacy Framework (DPF). It offers a Data Processing Addendum, and HIPAA support comes through a Healthcare Add-on with a signed BAA (Daily security).
Daily runs an EU call server in Frankfurt that you can select per room or domain, but its own documentation says calls still rely on some US-based services (Daily's European call server post). The DPF covers transatlantic transfers rather than guaranteeing EU residency, so confirm where media and recordings are processed before handling EU patient data.
Vonage Video API (the former OpenTok platform) is a US-based programmable video API within a broader communications platform. It supports data residency through a paid Regional Media Zones add-on, including an EU zone and an EU Proxy option for non-media traffic (Vonage Regional Media Zones). Vonage signs a BAA for the Video API, and its HIPAA set-up asks you to store and process protected health information in a US region (Vonage HIPAA compliance), so a HIPAA deployment and an EU-zone deployment are separate set-ups. Residency is an add-on you request per project, and archives stay in the selected region.
Twilio Programmable Video is a US-based programmable video API within Twilio's wider customer-engagement platform. Twilio announced in December 2023 that it would retire Programmable Video, then reversed that decision in October 2024 and kept it as a standalone product (Twilio changelog). It is a HIPAA-eligible service for which Twilio will sign a BAA, with eligibility tied to the Security or Enterprise Edition (Twilio HIPAA documentation).
Twilio lets you pick an EU media region, such as Ireland or Germany, per room, but accounts default to a US region and Twilio does not guarantee that all data stays in the selected region (Twilio video regions). EU-only residency for patient data therefore needs to be written into your agreement with Twilio.
LiveKit is an open-source (Apache 2.0) WebRTC stack that you can self-host or use as the managed LiveKit Cloud service. Self-hosting lets you control exactly where data is processed, which suits teams that want to keep patient data on their own EU infrastructure. LiveKit Cloud is SOC 2 Type II certified, and a HIPAA BAA (LiveKit HIPAA documentation) and EU region pinning (LiveKit data residency) are available on the Scale plan (a paid LiveKit Cloud tier) or higher. Region pinning covers signalling and media.
With self-hosting you own the full compliance programme: encryption, access control, logging and any BAAs with your own cloud provider. The BAA covers LiveKit Cloud only, so match the plan to your requirement.
This table is based on each vendor's publicly available documentation as of October 2026. 'Not stated' means no public claim for the healthcare context appears in the vendor's documentation, which does not mean none exists, so ask the vendor and confirm under your own DPA or BAA.
| Vendor | HQ | EU data residency | Health-data hosting credential | White-label embed | HIPAA BAA (US-facing) | Deployment |
|---|---|---|---|---|---|---|
| Digital Samba | Spain (EU) | EU/EEA only (media, recordings, session data) | Scaleway HDS-certified; Leaseweb NL NEN 7510 alignment statement | Full, API + SDK | Not on EU platform; via US infra or on-prem with your provider's BAA | Managed EU cloud or on-premises |
| Whereby Embedded | Norway (EEA) | Account data in Ireland; confirm media & recordings | Not stated | Yes, API + SDK | Yes, BAA; configure at API level | Managed cloud |
| Pexip | Norway (EEA) | Self-host / private cloud; confirm locations for hosted | Not stated; self-host = your infra | Via APIs; confirm branding | Describes platform as enabling HIPAA; confirm BAA | Self-host / private / managed |
| Daily | US* | EU call server (Frankfurt) selectable; not EU-only | Not stated | Yes, API + SDK | Yes, via Healthcare Add-on + BAA | Managed cloud |
| Vonage Video API | US* | EU zone via add-on (Regional Media Zones) | Not stated | Yes, API + SDK | Yes, BAA (health data in a US region) | Managed cloud |
| Twilio Video | US* | EU media region (Ireland, Germany); not EU-only | Not stated | Yes, API + SDK | Yes, HIPAA-eligible + BAA | Managed cloud |
| LiveKit | US* | EU region pinning (Cloud, Scale+) or self-host | Not stated; self-host = your infra | Yes, open-source + SDK | Yes (Cloud, Scale+) + BAA | Self-host or managed cloud |
*A US-headquartered vendor can fall under the US CLOUD Act even with an EU region selected (see criterion 1).
For a broader, non-healthcare view of these and other vendors, see our round-ups of the best video conferencing APIs and the top video conferencing SDK vendors.
The best video API for a healthcare platform is the one that keeps patient data under the data protection law that applies to your patients and your regulator.
For teams whose patients are in the EU, the European options are Digital Samba, Whereby Embedded and Pexip. Digital Samba keeps media, recordings and session data on EU infrastructure, is fully white-label for embedding inside a clinical product, and offers optional end-to-end encryption and a standard DPA. Whereby Embedded suits teams that want a lightweight embed with a BAA, and Pexip suits those that want to self-host.
For teams that need a signed HIPAA BAA, Whereby Embedded or a US-headquartered vendor that offers one, such as Daily, Vonage, Twilio or LiveKit Cloud, will usually be the practical route, with EU residency and jurisdiction checked separately if you also serve EU patients. Teams that must keep patient data on infrastructure they control, on-premises or in a private cloud, should look at Pexip, LiveKit or Digital Samba's on-premises option.
To go further on the building blocks, read our guides on crucial features for telehealth and mental-health platforms, encryption solutions for telehealth platforms, how to integrate video conferencing in a telehealth or mental-health app, privacy and security concerns in telehealth and remote patient monitoring.
For healthcare, a GDPR-compliant video API has to treat consultations as special-category health data under Article 9. In practice that means EU/EEA data residency for media and recordings, a Data Processing Agreement with clear controller and processor roles, a documented sub-processor list, and strong encryption. Our guide to GDPR-compliant video conferencing covers the general requirements.
Our standard EU platform is built for GDPR and is not run under a BAA. For HIPAA work, customers can use US-based infrastructure from us on a HIPAA-eligible provider, or deploy on-premises and sign a BAA with their own infrastructure provider.
On our standard EU platform, media, recordings and session data stay in the EU/EEA. Production runs on Leaseweb in Amsterdam and Scaleway in France, the Netherlands and Poland, with backup in Frankfurt (security white paper). Scaleway, one of our production providers, holds HDS certification; if you need HDS-certified hosting, talk to us about deployment options.
Yes. An embedded video API and SDK lets you render the consultation inside your own branded app, beside the patient record, rather than sending patients to a third-party page. Digital Samba is fully white-label, and its REST API, SDK and webhooks let your team connect calls to your EHR, scheduling and billing.
End-to-end encryption gives the strongest confidentiality for a consultation, because the vendor's servers only ever see ciphertext. It is especially valuable for one-to-one and small-group calls. The trade-off is that server-side transcription and captions are off, and a server-side recording suspends end-to-end encryption while it runs, although the call stays encrypted in transit. Because end-to-end encryption is set when the room is created, decide per room or consultation type whether consultations need to be recorded.
For an EU healthcare platform, look for a European, EU-hosted API that keeps patient data in the EU/EEA, embeds white-label and comes with a standard DPA. Digital Samba, Whereby Embedded and Pexip are the European-headquartered options in this comparison; check where each one hosts media and recordings in its entry above. If you need a signed HIPAA BAA, Whereby Embedded, Daily, Vonage, Twilio or LiveKit Cloud is usually the practical route.