Security Policy

1. Encryption

• In transit: all traffic between your device and Healthidia uses HTTPS (TLS). The app is served only over HTTPS.
• At rest: the managed database and file storage that hold your records and uploaded documents are encrypted at rest by our cloud infrastructure provider.
• Device credentials: access and refresh tokens for connected manufacturer health platforms are stored encrypted, never in plain text.

2. Authentication

• Email and password sign-in with email verification before an account is usable.
• Passwords are stored only as one-way salted hashes — we never see them.
• Passkeys (Face ID, Touch ID, Windows Hello, hardware security keys) are supported as a phishing-resistant sign-in method and can be managed from your profile.
• Sessions expire and refresh automatically; you can sign out at any time.
• Password reset is email-based with time-limited links.

3. Access control

Every table holding your data enforces database-level row-level security scoped to your account identifier. A signed-in user can only read or write their own rows — this is enforced by the database itself, not just by the interface. Uploaded documents live in private storage buckets and are served through short-lived signed links.

Healthidia is single-tenant per person by design: there is no doctor, clinic, or admin console that browses other people's records.

4. Audit logging

Sensitive actions — including device connection, consent grants and revocations, and synchronisation runs — are written to an append-only audit log tied to your account. Audit rows cannot be edited or deleted from the app.

5. Consent gates

Connecting a device or platform, and exporting or emailing a health summary, each require an explicit recorded consent step. Consent grants store the exact text you agreed to and can be revoked.

6. Server-side processing

AI extraction runs server-side so that provider credentials are never exposed to the browser. Requests are authenticated with your session token, and inputs are validated before processing.

7. What is not yet in place

We would rather tell you than imply more than we have:

• No independent third-party security audit or penetration test has been completed.
• No SOC 2, ISO 27001, HIPAA, or similar certification exists, and none is claimed.
• Multi-factor authentication beyond passkeys (for example TOTP codes) is not yet offered.
• Customer-managed encryption keys and formal backup restore testing are planned.

Healthidia is in beta. Please keep your original medical documents and do not treat the app as your only copy.

8. Reporting a vulnerability

Email support@healthidia.com with the subject line "Security". Please include steps to reproduce, test only against your own account, avoid accessing or modifying anyone else's data, and give us a reasonable period to fix the issue before disclosing it. We will acknowledge reports and keep you updated. We do not currently operate a paid bug bounty.

9. Related policies

See the Privacy Policy, Data Retention Policy, and Acceptable Use Policy.