Security

• Application hosted on secure, managed cloud infrastructure with automatic scaling
• Database hosted on Supabase (powered by AWS) with encrypted connections and automated backups
• All network traffic encrypted with TLS 1.2+ (HTTPS enforced)
• Database connections use SSL/TLS with connection pooling for performance and security
• Infrastructure monitored 24/7 with automatic alerting for anomalies

• User authentication via Google OAuth 2.0 (SSO) — we never store passwords
• Session management via secure, signed JWT tokens with automatic expiration
• Role-based access control: Patient Users can only access their own data; Clinic Admins can manage their clinic's data only
• Internal API endpoints protected with API key authentication and header-based authorization
• Admin dashboard access restricted to verified clinic owner email addresses

• Multi-tenant isolation: Every database query is scoped to the authenticated user and their clinic. One clinic cannot access another clinic's data under any circumstances.
• User-level isolation: Patient Users can only read and write their own health data (labs, supplements, protocols, blood pressure, chat history).
• Clinic-level isolation: Clinic Admins can view aggregate usage and manage users within their clinic only.
• Foreign key constraints and application-level checks enforce data boundaries at every layer.

• AI analysis is performed via third-party large language model APIs (processed in real-time, not stored by the AI provider for training)
• Only the minimum necessary data is sent to AI providers for processing (lab values, relevant context)
• We do not use your health data to train, fine-tune, or improve any AI models
• AI responses are generated on-the-fly and delivered directly to the user
• Chat history is stored in the database and scoped to the individual user

• Environment variables and secrets are stored securely and never committed to source code
• API keys are rotated periodically and scoped to minimum required permissions
• Dependency management with regular security audits and updates
• Application logging and monitoring for suspicious activity detection
• Secure development practices including code review and testing before deployment

Security is a shared responsibility. While we implement robust protections at the platform level, Clinic Customers are responsible for:

• Securing access to their clinic admin accounts
• Ensuring appropriate patient consent before uploading data
• Complying with applicable healthcare regulations in their jurisdiction
• Training their staff on secure use of the platform
• Reporting any suspected security issues promptly

If you discover a security vulnerability or have concerns about our security practices, please contact us immediately: