Built for healthcare.
Designed for trust.
Security isn't a feature we added — it's the foundation everything else is built on.
🔒 HIPAA Compliance
Carviq runs on HIPAA-eligible AWS infrastructure. Every plan includes a signed Business Associate Agreement (BAA).
- Encryption at rest (AES-256) and in transit (TLS 1.2+)
- Signed BAA included with every plan
- Comprehensive audit logging for all data access
- Regular security reviews and vulnerability scanning
🤖 AI Transparency
AI assists — it never acts alone.
Carviq's AI triages incoming messages by urgency, drafts responses in your provider's voice, and generates pre-visit briefs from patient history. Here's what it doesn't do:
- AI never sends a message without provider approval
- AI never accesses data outside your practice's environment
- AI models are not trained on your patient data
🏥 Data Ownership
Your data is yours.
Protected health information (PHI) lives in your practice's AWS environment. Carviq does not sell, share, or use patient data for any purpose other than providing the service to your practice.
- PHI stored in your dedicated AWS environment
- No selling or sharing of patient data — ever
- Data deletion available on request
- We don't access your data without explicit permission
🔐 Access Controls
Every provider gets their own login. No shared credentials, no shortcuts.
- Biometric authentication (Face ID or PIN) per provider
- Role-based permissions — MDs, RNs, and admins see only what they need
- No shared credentials across providers
- Automatic session timeouts
☁️ Infrastructure
Enterprise-grade cloud infrastructure, purpose-built for healthcare.
- AWS App Runner for application hosting
- Amazon RDS with encryption at rest
- Amazon S3 with encryption and all public access blocked
- US-based data centers (us-east-1)
- No PHI cached or stored on mobile devices
🤝 Subprocessors
We only work with HIPAA-eligible vendors.
- AWS — Cloud infrastructure and data storage
- Twilio — SMS notifications and family alerts
- SigmaMD — EHR sync (with Elation, athenahealth, DrChrono, and Hint Health coming soon)
📬 Questions?
Questions about security or privacy? We're happy to discuss our infrastructure, provide documentation, or walk through our compliance posture.