I'm trying to define a scoping definition, as required by ISO27001, for a company that offers advice to customers based on health-related data. The strength of this company is its advice that offers to customers (analytics techniques). The data are coming from different third-parties (e.g. health apps, hospitals) and everything is hosted on the cloud, analysis is on the cloud and security is guaranteed by the cloud provider (at some degree) as the data are siting on their servers (might be on 2-3 different geo-locations).
The way I m thinking to formulate it is like: ISMS covering collection, aggregations and analysis of data. Any ideas on this?