Source: https://vocarihealth.co/trust/documents

# Policies, terms, and assurance material.

Public documents are available immediately. Sensitive evidence and internal procedures are shared through a scoped customer security review.

## Public documents

Current privacy, security, and contracting material.

[**Security overview** Plain-English explanation of safeguards and safe workflow design. _Public_](https://vocarihealth.co/security) [**Control catalogue** Current technical, administrative, workforce, vendor, resilience, and vulnerability controls with implementation status. _Public_](https://vocarihealth.co/trust/controls) [**Privacy Policy** Website, account, business, consumer-rights, disclosure, retention, and security practices. _Public_](https://vocarihealth.co/privacy) [**Patient Privacy Policy** Patient-access processing, voice interactions, transcripts, insurance workflows, disclosures, and patient rights. _Public_](https://vocarihealth.co/patient-privacy) [**Website Terms of Use** Terms for public website and demonstration use. _Public_](https://vocarihealth.co/terms) [**Platform Terms** Customer responsibilities, service terms, data rights, security, liability, and commercial platform conditions. _Public_](https://vocarihealth.co/platform-terms) [**Business Associate Agreement** HIPAA business associate terms for healthcare customers. _Template_](https://vocarihealth.co/trust/baa)

## Security review package

Available to qualified customers after the review scope and recipient are confirmed.

**Security and HIPAA program overview** Program scope, governance, policy framework, control ownership, and assurance roadmap. _Prepared_

**Architecture and data-flow overview** System boundaries, PHI flows, trust zones, providers, integrations, and storage locations. _Prepared_

**Incident response and breach plan** Severity, roles, containment, evidence, customer notification, recovery, and post-incident review. _Prepared_

**HIPAA risk analysis and treatment register** Threats, vulnerabilities, likelihood, impact, safeguards, residual risk, owners, and remediation dates. _Prepared_

**Business continuity and disaster recovery plan** Critical services, dependencies, recovery objectives, communications, and test evidence. _Prepared_

**Vendor and BAA register** Named providers, purpose, data category, hosting region, service plan, contract, BAA status, and review date. _Prepared_

**Workforce security and training record** Access obligations, confidentiality, training curriculum, completion evidence, and offboarding controls. _Prepared_

**Vulnerability and penetration-testing package** Scan scope, remediation evidence, independent testing, and management response. _Planned_