Policies, terms, and assurance material.
Public documents are available immediately. Sensitive evidence and internal procedures are shared through a scoped customer security review.
Public documents
Current privacy, security, and contracting material.
Security overviewPlain-English explanation of safeguards and safe workflow design.PublicControl catalogueCurrent technical, administrative, workforce, vendor, resilience, and vulnerability controls with implementation status.PublicPrivacy PolicyWebsite, account, business, consumer-rights, disclosure, retention, and security practices.PublicPatient Privacy PolicyPatient-access processing, voice interactions, transcripts, insurance workflows, disclosures, and patient rights.PublicWebsite Terms of UseTerms for public website and demonstration use.PublicPlatform TermsCustomer responsibilities, service terms, data rights, security, liability, and commercial platform conditions.PublicBusiness Associate AgreementHIPAA business associate terms for healthcare customers.Template
Security review package
Available to qualified customers after the review scope and recipient are confirmed.
Security and HIPAA program overviewProgram scope, governance, policy framework, control ownership, and assurance roadmap.Prepared
Architecture and data-flow overviewSystem boundaries, PHI flows, trust zones, providers, integrations, and storage locations.Prepared
Incident response and breach planSeverity, roles, containment, evidence, customer notification, recovery, and post-incident review.Prepared
HIPAA risk analysis and treatment registerThreats, vulnerabilities, likelihood, impact, safeguards, residual risk, owners, and remediation dates.Prepared
Business continuity and disaster recovery planCritical services, dependencies, recovery objectives, communications, and test evidence.Prepared
Vendor and BAA registerNamed providers, purpose, data category, hosting region, service plan, contract, BAA status, and review date.Prepared
Workforce security and training recordAccess obligations, confidentiality, training curriculum, completion evidence, and offboarding controls.Prepared
Vulnerability and penetration-testing packageScan scope, remediation evidence, independent testing, and management response.Planned