Trust, stated plainly
Where the data lives, who can see it, how you take it back, and what is not in place yet. No badges we have not earned.
Last reviewed 3 November 2026
Where data lives
One server we run in Germany, AI providers in the United States, and nothing hidden about who else touches it.
- Hosting
- The app and its database run on one server we operate at Hetzner in Falkenstein, Germany (EU). AI processing does not stay in the EU: AI text runs on Anthropic’s Claude in the United States and imaging AI on Modal, also in the United States. Audio transcription and record search run on our own server in Germany. AI features are used under the AI features consent you give at sign-up, and every provider is listed on the subprocessors page. We will move all Kureon hosting to Canada.
- Who processes data for us
Hosting
Hetzner, Falkenstein, Germany. The app and its database run on one server we operate there.
AI text
Anthropic (Claude), United States, reached through the Claude command-line tool on our server under a Claude subscription account, not a negotiated enterprise agreement.
Imaging compute
Modal, United States.
Voice calls
ElevenLabs, United States, only for calls you start.
Email
Resend, United States.
Evidence search
Consensus, United States, search queries only.
Encrypted backup storage
Google Drive, United States. Backups are encrypted on our server before upload, so Google stores only ciphertext.
Network security and delivery
Cloudflare carries all site traffic (decrypted at its edge, health pages not cached), and routes claim emails only when you forward them.
Uptime monitoring
UptimeRobot, pings to a public status endpoint only.
Text messages through Twilio are built but switched off, so Twilio receives no data today.
- Encryption
- Everything travels over TLS. Off-site backups are encrypted on our server before upload, so the backup store holds only ciphertext. All copies, including encrypted backups, are deleted within 60 days of account closure. Encrypted backups themselves are deleted after 30 days. Encryption at rest is not yet enabled on the main server volume. It is on our roadmap below.
Who can see it
Only the people a family chooses, and a record of every time a shared record is opened.
- Access controls and roles
- Patients share per section and can revoke at any time. Behavioral health records need explicit consent for each share. Clinics have eight staff roles with separation of duties on coding review, and clinic membership never grants access to a patient’s record. Two-step sign-in with an authenticator app is available.
- Audit logs
- Opening a shared record is logged: who, when and which record. Patients see who opened their record and get an in-app notice when someone views what they shared. Clinic owners see an activity log of their team’s clinic work, metadata only, with a CSV export. It names a patient only when that patient shared their record with the clinician as their provider, and never shows a clinician’s personal or family activity.
- Business Associate Agreement
- Clinics accept an organization BAA with Kureon as a click-through. Each clinician accepts one before opening patient records. A BAA is the contract US health privacy law requires between a clinic and a company that handles its patient data. The template is drafted and under review by counsel. An EU Data Processing Agreement (DPA) is available the same way. A DPA is the contract EU privacy law requires with a company that handles personal data for you. We do not yet have a BAA with our AI vendors (Anthropic, Modal, ElevenLabs). So the clinic AI features that would send patient information to them are switched off until a covered AI provider is in place.
How you leave
Take everything with you, or have it deleted.
- Export and deletion
- Families export their records as a ZIP or a FHIR bundle (a standard file format for health records) at any time. Clinics export their own operational data as spreadsheets. Deleting an account removes its records within 30 days; audit and security logs are kept for up to 6 years.
What we do not claim yet
What is not in place, not certified or not cleared, stated as it is. We will not claim any of it before it is true.
- Encryption at rest is not yet enabled on the main server volume. It is planned and not claimed.
- SOC 2: controls documented, audit not yet performed. We do not hold a SOC 2 report.
- We do not hold HITRUST or ISO 27001 certification. There is no official HIPAA certification, and we do not claim one.
- No BAA or data processing agreement is signed yet with Anthropic, Modal or ElevenLabs.
- No independent penetration test has been done yet.
- The imaging AI is not a cleared medical device. Its readings are educational and never a diagnosis.
For the provider portal, a clinic can sign a BAA with Kureon, which covers Kureon itself; no subcontractor, including our AI vendors, is under a BAA with us yet. Personal patient accounts are covered by the FTC Health Breach Notification Rule and applicable state law. The full terms are in the legal hub.
Our commitments
- We never sell data, run no ad trackers and no analytics scripts. Only the cookies needed to sign in, stay secure and remember your language.
- Nothing consequential happens without a person’s explicit OK: AI drafts, people approve.
- When something on this page changes, we update this page.
Security contact
Found a vulnerability, or have a security or privacy question? Write to us directly.
Contact
Please include steps to reproduce and do not access other people’s data while testing. See also: privacy promise, privacy policy.