Security and data protection.

Encryption

Access controls

All roles follow the principle of least privilege. Admin and research tools operate primarily on de-identified views, not live PHI.

Audit controls

Network security

• Firewall protection on all network perimeters
• Intrusion detection and prevention systems (IDS/IPS)
• DDoS protection and rate limiting
• Regular vulnerability scanning and penetration testing
• Network segmentation to isolate sensitive data

Secure development

• Security-first development lifecycle
• Code review and static analysis for security vulnerabilities
• Dependency scanning for known vulnerabilities
• Regular security updates and patch management
• Secure coding standards and training for developers

Row-level security (RLS)

Database-level access controls enforce complete data isolation between users.

• Row-level security policies enforce data isolation at the database level
• Every query is automatically filtered by user_id and child_id
• No user can access another user's health data, even if they guess the ID
• RLS policies are independently tested from an unauthorized-user perspective
• Database queries fail closed (deny by default) if RLS is misconfigured
• RLS applies to all tables containing PHI or user-specific data

Voice data processing

Special safeguards for the voice journal feature.

• Voice recordings encrypted in transit and at rest
• Transcription through HIPAA-eligible providers with BAAs only
• Voice recordings retained per user preference, and can be deleted on request
• Transcription quality validation before clinical use
• Structured data extraction with fallback to free text if AI processing fails
• Users can review, edit, and correct all AI-extracted data before saving
• No voice recordings or transcripts sent to non-BAA-covered services

Security management

• Risk assessments: Annual comprehensive security risk assessments
• Security policies: Written security policies and procedures
• Incident response plan: Documented procedures for security incidents
• Disaster recovery: Business continuity and disaster recovery plans
• Regular reviews: Quarterly review and updates of security measures

Workforce security

• Background checks: Background screening for all employees with PHI access
• Security training: Annual security and privacy training required
• Access authorization: Formal authorization procedures for system access
• Access termination: Immediate revocation of access upon termination
• Confidentiality agreements: All workforce members sign confidentiality agreements

Third-party management

We carefully vet all service providers who may have access to your data.

• Vendor assessments: Security assessment before engagement
• Contracts: Business Associate Agreements or equivalent where applicable
• Ongoing monitoring: Regular review of vendor security practices
• Data processing agreements: Explicit limitations on data use and sharing

Environment controls

Separate infrastructure for development, staging, and production.

• Development and staging environments use only synthetic or de-identified data
• No real PHI is ever used for testing, development, or demos
• Database schema changes deployed via tested migrations with rollback capability
• Sandbox endpoints for AI, payment, and email services in non-production environments
• Strict network separation between production and non-production systems
• Production database credentials are never used in development or staging

Infrastructure security

• Data center security: Our cloud infrastructure providers maintain SOC 2 Type II certified data centers
• Physical access controls: Biometric access, 24/7 surveillance, and security personnel
• Environmental controls: Fire suppression, climate control, and power redundancy
• U.S.-based hosting: All production data hosted in U.S. data centers
• Geographic redundancy: Multi-region backup and failover capabilities

Device security

• Encrypted hard drives on all company devices
• Remote wipe capabilities for lost or stolen devices
• Automatic screen locking after inactivity
• Prohibition of PHI storage on personal devices

Data minimization

We collect only the minimum data necessary to provide our services. We do not collect:

• Advertising identifiers
• Precise location data (unless explicitly enabled)
• Social security numbers or financial information
• Unnecessary demographic data

Data retention

• Data retained only as long as necessary for service provision
• Voice recordings retained until the user requests deletion or the account is closed
• Transcripts retained according to user preferences and can be deleted at any time
• Users can delete voice recordings at any time from their account settings
• Account data deleted within 30 days of account closure
• Backups: Supabase Pro performs automated daily backups. All backups are encrypted at rest using AES-256 via Google Cloud infrastructure, consistent with Supabase's SOC 2 Type II certification. Backups are retained for 7 days on a rolling basis and purged from all systems within 90 days of account deletion.
• Audit logs retained for 7 years for security and compliance purposes

Data integrity

• Regular database integrity checks
• Backup verification and testing
• Version control for all data modifications
• User ability to review, edit, and delete their data

Data governance principles

Research participation (optional)

If you opt into the Research Databank, FlarePath supports two distinct research pathways with different data handling.

See the Beta User Agreement (Version 2.7, Sections 11a and 12) and the Research Databank Proposal for complete details on research pathways.

App security features

• Biometric authentication: Face ID, Touch ID (iOS), and fingerprint (Android) are supported for app unlock and sensitive operations. Biometric templates are stored exclusively in Apple Secure Enclave / Android StrongBox. FlarePath never accesses or stores biometric data itself; we store only a flag indicating whether biometric auth is enabled on the device.
• Secure storage: iOS Keychain and Android Keystore for credential and session token storage
• Certificate pinning: Prevention of man-in-the-middle attacks
• Code obfuscation: Protection against reverse engineering
• Jailbreak detection: Warning on compromised devices
• HealthKit data security (iOS): HealthKit data is read from Apple Health under explicit user authorization and stored in the user's encrypted FlarePath account. Access is read-only; FlarePath never writes to Apple Health. Users can revoke access at any time in iOS Settings. HealthKit data at rest is subject to the same AES-256 encryption and RLS controls as all other health data.
• Visit Companion recording security: Appointment audio recordings are encrypted in transit (TLS 1.3) and at rest (AES-256). Recordings are processed exclusively through BAA-covered AI endpoints and are never sent to non-BAA services. A clinician permission confirmation is required before recording begins. Users can delete recordings at any time; deletion removes both the audio and derived transcripts from all systems within 30 days.
• Push notification security: Push notification tokens are stored encrypted and used solely for sending the user's own app notifications. Tokens are never shared with third-party marketers and are invalidated when the user revokes notification permissions or deletes their account.

Data on device

• Minimal data caching on device
• Encrypted local storage when caching is necessary
• Automatic cache clearing on logout
• No PHI stored in device logs or crash reports

Incident detection

• 24/7 automated monitoring and alerting
• Intrusion detection systems
• Anomaly detection for unusual access patterns
• User reporting mechanisms for security concerns

Incident response

In the event of a security incident, we will:

• Immediate action: Contain and mitigate the incident within 24 hours
• Investigation: Conduct a thorough investigation to determine scope and impact
• Notification: Notify affected users within 72 hours if PHI is compromised
• Clinical trial notification: If a breach affects clinical trial participants, notify the Principal Investigator and sponsor per the trial-specific protocol within 24 hours
• Remediation: Implement corrective measures to prevent recurrence
• Documentation: Maintain detailed incident logs and lessons learned

Breach notification

If we discover a breach affecting your data, we will notify you via email to your registered address, an in-app notification, and a notice on our website if the breach affects 500 or more users.

The notification will include a description of the incident, the types of information involved, the steps we are taking, the steps you can take to protect yourself, and contact information for questions.

Account security

• Strong passwords: Use unique, complex passwords
• Enable MFA: Turn on multi-factor authentication
• Keep credentials private: Never share your password or login information
• Secure your device: Use device passcodes and biometric locks
• Update regularly: Keep your app and device OS up to date

Safe practices

• Log out when using shared devices
• Be cautious of phishing emails or suspicious messages
• Verify you are on the official FlarePath app or website
• Report suspicious activity immediately
• Review your account activity regularly

Reporting security concerns

If you suspect a security issue, contact us immediately. We will acknowledge within 24 hours.

• Security: security@flarepathhealth.com
• Support: info@flarepathhealth.com

HIPAA alignment

While FlarePath is not a HIPAA-covered entity, we voluntarily implement technical, administrative, and physical safeguards that align with HIPAA Security Rule requirements, including:

• 45 CFR § 164.308 — Administrative Safeguards
• 45 CFR § 164.310 — Physical Safeguards
• 45 CFR § 164.312 — Technical Safeguards
• 45 CFR § 164.316 — Policies, Procedures, and Documentation

Industry standards

We follow industry best practices including:

• NIST Cybersecurity Framework: Risk management and security controls
• OWASP Top 10: Protection against common web vulnerabilities
• SOC 2: Infrastructure providers are SOC 2 Type II certified
• ISO 27001: Information security management principles

State privacy laws

We comply with applicable state privacy laws, including the California Consumer Privacy Act (CCPA), the Virginia Consumer Data Protection Act (VCDPA), and other state-specific requirements.

International users and GDPR alignment

During the Beta testing period, FlarePath welcomes international users. For all users, regardless of location, we apply GDPR-aligned principles.

• Data minimization: We collect only data necessary for the service
• Purpose limitation: We use data only for stated purposes
• Right to erasure: You can request deletion of your data at any time
• Right to access: You can request a copy of all data we hold about you
• Right to rectification: You can correct inaccurate data
• Right to data portability: You can export your data in a standard format
• Lawful basis: We process data based on consent and legitimate interests