Security
What we protect.
What we do not claim yet.
You are handing us your member list. This page is written so that you, your partner, or whoever reviews vendors for you can see exactly where the lines are. Specific controls and contract terms are reviewed with each practice before launch.
The clinical line
Software gathers and drafts.
A clinician decides.
Every request is classified by authority before anything happens: an answer, an action the member confirms, or a decision. Diagnosis, treatment, prescribing, refill approval, and urgency are classified human-only in the system itself. Software cannot lower that classification, and it cannot close a request.
Patient chat tells members it is AI and that their conversations are saved for the care team. Drafted replies and scribe notes stay drafts until a qualified person sends or signs them.
- 1 Any staff
Answer
Hours, benefits, policy, status
- 2 Member confirms
Act, after the member confirms
Book or cancel a visit, update a card
- 3 Clinician only
Decide
Refill approval, dosage, urgency, diagnosis
What is in place
Controls, not adjectives.
Each of these is a property of the system today, not a roadmap item.
- One practice per record
- Every row in the database carries a practice identifier, and every query is scoped to it. Our internal admin tools sit behind a separate, invitation-only login with MFA.
- Clinical authority by role
- Only a qualified clinical role can take, answer, or resolve a clinical request. Billing and front-desk roles cannot close clinical work. The practice assigns roles, not us.
- Its own AWS account
- Practice Portal runs in a dedicated AWS account, separate from our other products and their infrastructure.
- Encryption in transit and at rest
- TLS for every connection. Encrypted storage for the database, attachments, and backups. App signing keys and scribe recordings are encrypted under keys managed in our AWS account.
- Malware-scanned files
- Uploaded documents stay unavailable for download, preview, or release until a scan marks that exact version clean. A failed scan never falls back to allowing the file.
- Append-only audit trail
- Administrative, billing, request, settings, and publishing actions are recorded with who, what, and when. Staff can correct a record with a reason; they cannot erase the history.
- Consent on the record
- What a member agreed to, which version, and when. Revoking consent stops new actions and cancels ones already proposed.
- Per-device sessions
- Mobile sessions are bound to a device with a revocable refresh token. Sign-out on one device does not touch the others. Biometric unlock stays on the device.
- Confirmations before consequential actions
- Booking, cancelling, or changing a payment method requires the member to confirm immediately before it happens. Confirmations expire. The wrong approver is rejected.
- Receipts for every external write
- Each write to your EMR or billing system records what was sent, what came back, and whether it matched. Duplicates and retries converge on one effect.
- Payment data stays with the processor
- Cards and bank accounts are tokenized by Stripe and paid into the practice's own Stripe account. Practice Portal never stores a card number.
- Authenticated email
- Email is DKIM-signed with SPF and DMARC. Each practice's newsletters send through their own isolated tenant, separate from appointment and account email.
- You hold the publishing keys
- Your app is published under your own Apple and Google accounts. Your owner authorizes our access and can revoke it; signing keys are never shown in the interface.
- Business Associate Agreement first
- No member data is exchanged until a BAA and a security review are complete. That is a precondition of onboarding, not a checkbox at the end.
AI, specifically
What each AI feature sees, where it runs, and who decides.
Every AI feature is off until it is enabled for your practice.
- Patient chat
- Sees the member's current prescriptions, your visit types, and the recent conversation. Runs in our AWS account through a private gateway, with no fallback to an outside AI service. Every conversation is saved for your clinical team. It cannot book, refill, message, or change anything.
- Clinician scribe
- Exam-room audio is transcribed and drafted within our AWS account after the clinician confirms every attendee agreed. Recordings are encrypted and deleted after 24 hours by default. The output is a draft; only the clinician signs it.
- Medication education
- The prescription and the clinician's notes go through the same private path in our AWS account. Drug lookups to the National Library of Medicine carry drug names only, never patient data. Nothing is published until the clinician approves it.
- Drafted replies
- Prepared only when a staff member asks for one, and never sent by software. A qualified person edits and sends, or discards it with a reason.
Subprocessors
Who else touches the data.
The complete list. Several only apply once you turn the matching feature on.
| Company | Purpose | When |
|---|---|---|
| Amazon Web Services | Hosting, storage, email, malware scanning, speech transcription, built-in video visits, and AI models | Always |
| PlanetScale | Database | Always |
| Cloudflare | DNS, edge routing, and app update delivery | Always |
| Stripe | Membership billing and payments | When billing is on |
| Elation Health or Cerbo | EMR integration (the one your practice connects) | When connected |
| Zoom | Video visits, on the clinician's own account | When a clinician chooses Zoom |
| Apple and Google | App distribution and push notification delivery | With the mobile app |
What we do not claim yet
Honest about the gaps.
A vendor that says "fully HIPAA compliant out of the box" is telling you they have not read the rule. Here is where we actually stand.
- SOC 2 or HITRUST attestation
- Not yet. Controls are in place; the third-party audit is not. We will publish the report when we have it, not before.
- Independent penetration test
- Not yet completed. We will say so here when it is.
- A public Practice Portal app
- There is none, by design. Each practice's app is published under that practice's own Apple and Google accounts as it launches.
Questions
Send this page to whoever reviews your vendors.
Then contact us with what they ask. We would rather answer it now.