Security & HIPAA
HIPAA-ready care for your protected information
HIPAA-ready architecture for your protected health information. A Business Associate Agreement is available on request, and your information is never used to train AI models.
How we protect your information
Safeguards built into how we work
Privacy is the foundation of therapy. These technical and administrative safeguards keep your information protected at every step.
Encryption in transit and at rest
All data is encrypted while moving between your device and our systems and while stored. Telehealth sessions run over encrypted channels.
Least-privilege access with MFA
Access is limited to the minimum people who need it, and every account is protected by multi-factor authentication.
Audit logging
Access to records is logged so we can review who viewed or changed what, and when.
No model training on your data
We do not use your information, session content, or records to train AI models. Your data is never training data.
Configurable retention and deletion
Records are kept only as long as needed and no longer. You can request deletion of your information at any time.
Client data isolation
Each client's information is isolated so it is only visible to you and the clinician who supports you.
Our HIPAA approach
The commitments behind the safeguards
Being HIPAA-ready is more than technology. These commitments keep our practice and partners aligned with the Privacy and Security Rules.
Business Associate Agreements
We sign a BAA with every healthcare partner and vendor that may come into contact with protected information.
Subcontractor BAAs
Any subcontractor that handles protected information signs a BAA before access is granted.
Annual risk analysis
We review our safeguards at least annually and after any significant change to how we operate.
Workforce training
Everyone with access completes privacy and security training before handling any client information.
Incident response & breach notification
We follow a documented incident response plan, and we notify affected clients as required by law if a breach occurs.
What we need from you
A few things to keep your information safe
- Do not share medical details, diagnoses, medications, or insurance IDs through public forms or chat. Use the client portal or speak with your clinician directly.
- Keep your portal login private and enable multi-factor authentication where available.
- Sign a BAA before sharing any protected information with us as a business associate.
- Let us know if you would like your information updated or deleted, and we will respond within one business day.
HIPAA FAQ
Questions about privacy and security
Straightforward answers about how your information is protected. If you have a question that isn't here, reach out and we'll answer it directly.
Request a BAA
Request your Business Associate Agreement
Tell us about your practice and we'll send a BAA within one business day. Please do not include any patient or medical information in this form.
Informational only, not legal advice. Compliance depends on your configuration and a signed BAA. This page describes our safeguards and does not create a legal obligation beyond our signed agreements.