Security & compliance

The short version: we hold almost no data about your patients.

This page is written for whoever runs your vendor review. It states what we have and what we don't, because you should be able to make this decision without taking our word for anything.

Where we stand on certifications

Being direct, because these are the two questions every health system asks first:

Not audited

SOC 2

We do not have a SOC 2 report. Not a Type I and not a Type II. A SOC 2 is an attestation issued by a licensed CPA firm after an observation window — it isn't something a vendor can switch on per customer or per location, and we're not going to describe it that way. It is on our roadmap, and we'll say so plainly until the day a real report exists.

Out of scope

HIPAA

We are not a HIPAA Business Associate today, and we have no BAA in place — because the triage chat collects no protected health information at all. There is no name, no date of birth, no insurance ID, and no account. Rather than claim compliance with a rule we don't fall under, we'd rather show you the data we actually hold, below.

The condition that would change this: if we ever add booking that carries a patient identifier — a name attached to an appointment, for instance — we become a Business Associate at that moment. A signed BAA and real HIPAA controls become prerequisites for shipping it, not follow-up work. We'd rather you hold us to that in writing now than discover it later.

What we actually store

Surface	What's stored	Retention
Triage conversation	Nothing. Message content is sent to the model to generate a reply and is not written to our database. There is no transcript to subpoena, breach, or hand over.	Not retained
Clinic search	The zip code searched. No IP address, no precise location. If a patient uses “near me,” coordinates are used for the lookup and never written down.	Not retained
Clinic clicks	A random per-browser session ID, which clinic was clicked, the action (directions / call / website), and the searched zip. The session ID is not linked to any identity and is discarded when the browser tab closes.	Retained for reporting
Opt-in follow-up text only if used	A phone number, and which clinic it relates to — collected only when a patient explicitly types it in to receive one check-in message. This is the single place we hold anything identifiable about a patient. It can be disabled per tenant.	Retained after sendingBeing straight with you: our privacy policy implies this is deleted once the message goes out, and today the code keeps it. We're fixing the code rather than softening the policy.
Listing claims	A business contact name and email, submitted by clinic staff — not patients.	Retained until reviewed

Controls in place today

No patient accounts. There is no login, no password, and no session to hijack — so there are no patient credentials to breach in the first place.
Row-level security on every table. The public key can only read clinic listings and active tenant branding, and can only insert claims and follow-up opt-ins. It cannot read them back.
Privileged keys never reach the browser. The service-role database key and all third-party API keys live only in server-side environment variables.
Rate limiting. The chat endpoint is capped per IP to limit abuse and cost.
Emergency screening runs independently in two places. Red-flag detection runs in the browser and again on the server, so a failure in one layer doesn't mean an emergency goes unflagged.
TLS everywhere, terminated at the edge, with no plaintext origin.
Tenant portals are excluded from search indexes, so a branded deployment doesn't surface publicly before you're ready for it.

Subprocessors

These vendors process data on our behalf. Several hold their own SOC 2 — that is their attestation covering their infrastructure, and we list it as context, not as a substitute for one of ours.

Vendor	Purpose	Sees
Vercel	Hosting, CDN, edge routing	Requests in transit
Supabase	Postgres database	Everything in the table above
Anthropic	The model behind the conversation	Message content, not retained by us
Google	Clinic search and geocoding	Zip code or coordinates
Twilio	The opt-in follow-up text	Phone number — only if that feature is enabled for you

Questions we haven't answered here

If your security team has a questionnaire, send it — we'll fill it in honestly, including the rows where the answer is “not yet.”

urgentcarechat@icloud.com