We sign a Business Associate Agreement with every covered entity that uses The Clinic. The full text is a short, readable document — not a 40-page legal tangle — and we'll countersign yours or ours. This page summarizes what it commits us to.
We use Protected Health Information only to provide, manage, and support the services you contract us to deliver — and as required by law. We do not sell PHI, we do not share it with advertising networks, and we do not use it to train foundation models.
Administrative, physical, and technical safeguards as required by 45 CFR §§ 164.308, 164.310, 164.312. In practice: per-tenant isolation enforced in the application layer and independently by database row-level security, encryption at rest (AES-256) and in transit (TLS 1.2+), per-clinic data-encryption keys, role-based access controls, and two-factor authentication that your administrators can require for every account.
Our current subprocessor list, including which subprocessors may access PHI, is published at /security/subprocessors. We will not add or replace a subprocessor that may access PHI without at least thirty (30) days’ written notice to you.
We notify you without unreasonable delay and in no case later than 30 days after discovery of a reportable breach of unsecured PHI, per 45 CFR § 164.410 — with the facts, the affected records, the corrective action, and the evidence we have. Where the Data Processing Addendum also applies, we notify you within seventy-two (72) hours as provided there.
We support your obligations under the Privacy Rule: access requests, amendments, accounting of disclosures, and restrictions. Our admin surface exports the per-patient audit log and record set on demand.
When the underlying services agreement ends, we return or securely destroy all PHI within 60 days, with written attestation. If return or destruction is infeasible for a specific record class, we tell you which class and why — and extended protections continue to apply.