Safeguards you can understand.

• HTTPS for the live website and protected staff sessions.
• Organization-scoped lookups and permission checks for clinic intake records.
• Role-based staff membership managed by workspace owners.
• Patient access limited to one assigned questionnaire, with hashed access codes, a date-of-birth check, expiry, and a limit on verification attempts.
• Signed submission snapshots and read-only submitted responses.
• Administrative audit events for supported workspace and intake operations.

We have not verified a completed HIPAA readiness assessment or executed business associate agreements for the current deployment. The application safeguards listed above are not a certification of HIPAA compliance.

Before using the deployment for protected health information, your organization must confirm the applicable agreements, eligible infrastructure and services, encryption and backup arrangements, access procedures, risk assessment, retention policies, and incident-response responsibilities.

HHS explains the role of business associate agreements and the requirements for cloud services handling electronic protected health information.

We do not currently claim SOC 2 certification, HITRUST certification, a third-party penetration-test result, or a formal accessibility conformance assessment. Ask us for the current evidence relevant to your organization’s review.

Automatic email delivery, document uploads, and external healthcare integrations require separate configuration and review. They should be enabled only after the appropriate service and agreement requirements are confirmed.

Staff access should match each person’s responsibilities. Application checks restrict intake lookups to the authorized clinic and patient access to one assignment. Operational processes for access reviews, removals, log handling, and retention must be defined for the deployment.

The current application is hosted on DigitalOcean with a private application database. A healthcare readiness review must verify hosting and provider eligibility, applicable agreements, encryption at rest, backups, recovery testing, and monitoring. This page does not establish that those operational requirements have been completed.

Document service boundaries are designed around private storage and limited-duration access. Document uploads are disabled on the current deployment. Storage provider setup and validation are required before using that capability.

Incident-response ownership, escalation channels, notification responsibilities, and recovery procedures must be documented and reviewed before production healthcare reliance. Report a concern without sending patient information through the public form.

Use our contact form and select “Security concern.” Include the affected page and a brief description, without patient data, credentials, or access codes. We can arrange an appropriate channel for further details.