A med spa patient app holds health information. This page lists exactly what protects it: the agreement, the hosting, the encryption, the controls your team uses, the vendors that touch it, and what stays with you.
The same Business Associate Agreement on every plan · No SOC 2 report or HITRUST today; ask us about our roadmap
Each item is in the product today. Where a setting is yours to turn on, it says so.
You accept the BAA together with the Terms when you create your clinic account; signup does not complete without it. The acceptance record (version, name, email, date) and a completed copy of the agreement sit in your dashboard under Settings → Legal. Starter, Growth and Signature get the same agreement.
The portal runs on HIPAA-eligible AWS services in US regions under the AWS Business Associate Agreement. Records live in MongoDB Atlas on a dedicated three-node cluster with disk encryption at rest and TLS in transit, on the tier that supports a Business Associate Agreement. Connections terminate on TLS 1.2 or 1.3 and browsers are told to use HTTPS only (HSTS) for a year.
On top of disk encryption, the application encrypts the free-text clinical fields with AES-256-GCM before they are written: the product name, site, notes and side effects on each entry in a patient's treatment log; the product, site, notes and outside-provider details on a treatment plan; notes on weight entries and progress photos; intake form answers; and the body of every message. Your Stripe and HighLevel credentials are encrypted the same way. The key is a secret loaded at boot, never stored with the data.
Every database query is scoped to your clinic, so your team only ever sees your patients. There is no standing platform access to your account: a support session has to be started by a platform administrator, expires after one hour, and is written to the audit log with who started it and when.
Three roles: the owner (billing included), admins (everything but billing) and front desk (patients and orders only). Every owner and admin can turn on two-factor sign-in under Settings → Security: scan a QR code with any authenticator app, confirm a six-digit code, and every sign-in after that asks for one. Turning it off needs a current code, and enabling, disabling and failed codes are all logged. Staff sessions expire after 12 hours.
Each read or change of patient data in the dashboard, the API and the HighLevel panel writes an entry: who, which record, what action, when, from which address and browser. Exports, account deletions, two-factor changes and support sessions are logged the same way. Entries are kept for six years, the period the HIPAA documentation rule sets, and your account owner can ask us for them at any time.
Photos are stored under a private prefix with no public access. The app and the dashboard fetch each one through a signed link that is issued only to a signed-in user and expires after an hour. In the dashboard they stay blurred until a staff member clicks Reveal photos, so a screen left open at the front desk shows nothing.
Order emails show item counts and prices, never product names. Reminder emails and push notifications say a reminder is due and point into the app; subject lines never name a product or a condition, because they show on lock screens. Stripe holds card details, which never touch our servers, and the payment metadata we send Stripe carries IDs and amounts; what else Stripe handles is in the vendor table below. Retargeting emails are built without any treatment detail.
The subcontractors in Schedule A of the BAA, and nothing else. We update this list before a new vendor handles any data.
| Service | What it does for the portal, and what it handles |
|---|---|
| Amazon Web Services (AWS) | Hosting and infrastructure: application servers, file storage, content delivery, secrets management. Handles: All Platform data, including PHI, in US regions. |
| MongoDB Atlas | Managed database. Handles: All Platform records, including PHI, encrypted in transit and at rest. |
| Stripe | Payment processing for the clinic's connected Stripe account and platform billing. Handles: Payment details, order amounts and descriptions, patient name and email. |
| EasyPost | Shipping labels and package tracking. Handles: Recipient name, shipping address, package details, tracking events. |
| Resend | Transactional email delivery: account, order and shipping notices. Handles: Name, email address, message content. |
| Expo | Push notification delivery to the patient app. Handles: Device push tokens and notification text (notifications carry no clinical detail by policy). |
Systems you connect yourself, such as your CRM or your own Stripe account, are your vendors and are not on this list. The same list is in your dashboard under Settings → Legal.
Three parties handle a patient's information: your clinic, the patient, and the vendors above. This is the path it takes and what guards each step.
A patient signs up on your portal or in your app, under your name. Everything they enter (weight, treatment log entries, photos, intake answers, messages) travels over TLS to our API and lands in your tenant in MongoDB Atlas, with the free-text fields encrypted before they are written. Rate limits on the API, on sign-in (ten attempts per fifteen minutes), on two-factor codes and on password resets slow down anyone guessing.
Your staff see it in the dashboard according to their role, on a session that expires after 12 hours, with two-factor if they have turned it on. Every record they open is logged. Photos stay blurred until revealed.
What leaves the portal is deliberately thin. Email and push carry a name and a notice, never a treatment detail; the detail waits behind login. Messages between you and a patient stay inside the portal, and the notification only says a message is waiting.
Only the services in the table receive data, each for the job named there. Credentials for every service are loaded at boot from AWS Secrets Manager; none are in the code, the build or the container image.
If you connect HighLevel, the contact, payment, tag and progress fields you configure are pushed to your location on your instruction. Your HighLevel account, your own Stripe account and any tracking pixel you add are your vendors under the BAA, so the agreements with them are yours.
A patient can download their full record and delete their account from the app; deletion asks them to type their email to confirm and is logged. Your clinic can request a complete export at any time. If you leave, the BAA commits us to export your data on request and then delete our copy, keeping only the audit logs the law requires us to hold.
The BAA is two-sided. These are the parts only you can do.
No software is. There is no HIPAA certification; there is a law, and a vendor either builds for it and signs a Business Associate Agreement or does not. We do both. The safeguards on this page map to the HIPAA Security Rule, and the BAA is accepted at signup on every plan.
Yes. The same agreement covers every plan, from Starter at $199 a month up. You accept it with the Terms at signup, and a completed copy with your acceptance record is in Settings → Legal.
Not today. The technical controls are listed above, and we are happy to walk your IT or compliance person through them on a call. Ask us about our roadmap.
It is available to every owner and admin login, and each person turns it on under Settings → Security with any authenticator app. We recommend it for everyone who can open a patient record.
The portal is covered. HighLevel is your vendor: it is your account, and you choose what syncs into it. If you push patient data to HighLevel, the HIPAA terms you hold with HighLevel apply to that copy. The help center explains what each sync layer sends so you can decide.
Yes. From the app settings a patient can export their complete record (the download opens in a browser) or delete their account after confirming their email. Both are written to the audit log. Your clinic can request a full export of its own data at any time.
The BAA is public, the same on every plan, and accepted with the Terms at signup. 14 days free, no card.