Security overview
Encryption, MFA, audit log, tenant isolation.
ReadTrust center
Compliance, shipped in code.
We treat trust the way we treat clinical evidence: cited, verifiable, and re-validated on every release.
HIPAA
§164.308 / .310 / .312 controls + BAA on every covered subprocessor.
ReadPrivacy policy
GDPR + CCPA + general. What we collect, why.
ReadTerms of Service
Acceptable use, liability, termination.
ReadCookie policy
Essential only. No third-party tracking.
ReadData Processing Agreement
Standard DPA covering EU/UK transfers.
ReadBusiness Associate Agreement
HIPAA §164.504(e) compliant BAA.
ReadService Level Agreement
Uptime targets and credits per tier.
ReadAcceptable Use Policy
What you can and cannot do on the platform.
ReadSubprocessors
Every covered subprocessor + BAA status.
ReadAccessibility statement
WCAG 2.1 AA target. Active program.
ReadGDPR rights
EU data subject rights under Articles 15-22.
ReadCCPA rights
California consumer privacy disclosures.
ReadStatus page
Uptime and incident history.
ReadResponsible disclosure
Security researcher program + safe harbor.
ReadIncident reporting
How to report a security or privacy incident.
ReadSMS terms & opt-in
Twilio A2P 10DLC + TCPA disclosures. Opt-in, frequency, STOP/HELP.
ReadAntibiotic Stewardship methodology
42 CFR §483.80(a)(4) + CDC Core Elements + Loeb / McGeer references.
ReadDrug interactions — methodology
How label-grounded DDIs are sourced, pulled, and verified. Educational reference, not CDS.
ReadIn-app Help AI methodology
How the in-app Help drawer + page-context AI work, what they do not do, how queries are audited without storing raw text.
Read