Trust & Security

1. Our position under HIPAA

When your clinic uses Homeostasis for its patients, your clinic is the covered entity and Titra Health LLC is your Business Associate. We sign a Business Associate Agreement with every clinic before any patient data flows, and every subprocessor of ours that can touch PHI has signed a BAA with us.

We handle PHI only to perform the service, only as the BAA permits, and only as you instruct. We do not use it for our own marketing, we do not sell it, and we do not let it train anyone's models.

2. How access works

The access model is deliberately narrow, because the safest design is one where a broad disclosure is not possible in the first place.

• A clinic sees only its own patients. Access is scoped to patients linked to that clinic. There is no shared pool and no cross-clinic view.
• A patient sees only their own record, enforced in the database rather than in application code.
• The patient account exists before the patient does. Your staff provision it from the chart; the patient claims it with an eight-character code and their date of birth. The code alone is not sufficient.
• We read your medical record; we do not write to it. The EMR connection is read-only. Nothing the app or a patient does alters your chart. A clinician decides what, if anything, is carried across.
• Your clinic controls its own user list — who holds a dashboard account, and removing them when they leave.
• Sessions on shared hardware lock and time out, so the exam-room tablet does not leave the last patient's record open for the next person.

3. Technical safeguards

Scroll the table sideways to see every column →

4. Audit and accounting

HIPAA §164.312(b) requires records of activity in systems holding PHI. Ours cover:

• Writes to clinical records — logged at the database level across the clinical tables, capturing who and when.
• Staff access to a patient record — logged on the dashboard.
• Every view of a patient photograph — logged individually: which photograph, which staff member, from where, and when.
• Disclosures — recorded so we can support your accounting-of-disclosures obligation under §164.528.
• AI activity — recorded as metadata only. We deliberately do not store the question, the answer or the payload.

Audit records are kept for six years and survive account deletion, as HIPAA requires. They record that an access happened; they do not retain clinical content.

5. AI and PHI

Our AI Policy is the full account. For a compliance review, the load-bearing facts:

• OpenAI is our only model provider, under a signed BAA with zero data retention — prompts and completions are not persisted after the request.
• No data is used for model training, by us or by any provider.
• Direct identifiers — name, date of birth, email, account ID, clinic code — are stripped before the request leaves our servers.
• Patient consent is enforced server-side on every request, not merely in the app's interface.
• The AI makes no clinical decision, writes nothing to your chart, and triggers no automated clinical action.
• Your chart data, patient photographs, and patient–clinic messages are never sent to an AI provider.

6. Subprocessors

The complete list of third parties that process data on our behalf. We keep it here so it can be checked rather than requested.

Scroll the table sideways to see every column →

On push notifications. Push traffic traverses Apple's and Google's networks, which no vendor can place under a BAA — a claim to the contrary should make you suspicious of the vendor making it. We address it by design instead: notification bodies carry no clinical detail. A reminder says it is time to log; it does not name a medication, a dose or a result.

We will give clinics notice before adding a subprocessor that would handle PHI, and this page is updated whenever the list changes.

7. Retention and destruction

• Active patients: records are retained while the account is active and the clinic relationship continues.
• Patient-initiated deletion: profile, logs, conversations, photographs and stored files are purged within 30 days — including objects in file storage, not only database rows.
• Generated documents are purged on a schedule rather than accumulating; share links are short-lived and revocable.
• Caches are pruned automatically.
• Audit and disclosure logs are retained six years per HIPAA, and are excluded from deletion by design.
• On termination: at your instruction we return or destroy the PHI we hold for you, subject to the audit-log retention above, and certify what was done.

Deleting a Homeostasis account never touches your clinic's own medical record. That remains yours, under your retention schedule.

8. Breach notification

If we discover a breach of unsecured PHI, we notify the affected clinic without unreasonable delay and no later than 60 days from discovery, per §164.410. Our notice identifies the patients involved, what happened, when, what information was affected, what we have done, and what we recommend — everything you need for your own notification obligations.

For direct consumer users, we follow the FTC Health Breach Notification Rule and applicable state breach laws.

We maintain a written incident response plan and test it. It is part of the documentation package below.

9. Patient rights requests

Where we act as your Business Associate, patient rights under HIPAA run through your clinic, not through us. That is the correct routing, and it is what we tell patients.

If a patient contacts us directly, we do not act on the request ourselves — we direct them to you and tell you it happened. When you need our help to answer one, we support access, amendment and accounting-of-disclosures requests within 15 days of your asking, so you have time inside HIPAA's 30-day window.

10. Reporting a vulnerability

If you believe you have found a security vulnerability, email support@titrahealth.io with "Security" in the subject line. Tell us what you found and how to reproduce it.

We will acknowledge within two business days and keep you updated until it is resolved. We will not pursue legal action against anyone who reports in good faith, acts only against their own account or test data, does not access or modify another person's information, and gives us a reasonable window before disclosing publicly.

11. Requesting the package

For a vendor security review or a compliance file, we can provide:

• Our Business Associate Agreement
• Security Risk Analysis (§164.308(a)(1))
• Incident response and breach notification procedures
• Access control, retention and destruction policies
• Encryption attestation
• Named Security Officer and Privacy Officer
• Workforce training and sanction policy
• Contingency and backup plan
• Subprocessor list with executed BAAs
• A completed security questionnaire in your own format

Email support@titrahealth.io and say which you need. We would rather send it before you ask twice.