Skip to content

Compliance & Trust Center

Compliance isn't a feature. It's the foundation.

Every layer of this platform was engineered for healthcare from day one, not bolted on after the fact. This page is the section your attorney will want to review.

Infrastructure

Built for healthcare compliance from the ground up.

Four pillars of compliance infrastructure that protect your brand, your patients, and your business.

HIPAA-Compliant Infrastructure

Patient data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Access controls, audit logging, and breach notification protocols are built into the core architecture. Infrastructure is purpose-built for protected health information.

  • AES-256 encryption at rest
  • TLS 1.2+ encryption in transit
  • Role-based access controls
  • Complete audit logging
  • Documented breach notification procedures

Licensed Provider Network

Providers include licensed physicians, nurse practitioners, and PAs credentialed across all 50 states. Every consultation follows that state's specific telehealth prescribing laws. Regulatory changes are monitored at the platform level.

  • Credentialed across all 50 states
  • State-specific prescribing law compliance
  • Automated state-aware patient routing
  • Continuous regulatory monitoring

Verified Pharmacy Network

Every pharmacy holds active state board licenses and undergoes regular inspection. For compounded products, the network includes exclusively 503A and 503B-compliant compounding pharmacies. Chain of custody is documented from prescription to doorstep.

  • Active state board licenses verified
  • 503A/503B compounding compliance
  • Documented chain of custody
  • Regular third-party inspection

BAA Execution & Maintenance

A Business Associate Agreement isn't optional when handling PHI. It's the law. BAAs are executed as a standard part of onboarding. The legal team maintains them as regulations evolve.

  • Executed with every customer at onboarding
  • BAAs at every layer of the infrastructure stack
  • Maintained and updated as regulations change
  • Covers all administrative, physical, and technical safeguards

SOC 2 Type II Audit In Progress

Our infrastructure is built to SOC 2 Type II standards. Independent audit is underway with expected completion in Q3 2026. SOC 2 provides independent third-party verification of security controls, availability, and confidentiality practices.

Responsibilities

You run the brand. We run the compliance.

Telehealth compliance is a full-time job. Here's what the platform handles so you can focus on building your business.

What you'd normally need to figure out
What we handle
Hiring a HIPAA compliance officer
Built into the platform architecture: automated safeguards, audit logs, access controls
Finding and credentialing providers in every state you sell in
Provider network is pre-credentialed and licensed. Patients matched to appropriately licensed providers automatically
Tracking state-by-state telehealth prescribing laws
Platform workflows are state-aware. Rules engine updated as regulations change
Vetting and contracting with licensed pharmacies
Pharmacy network is pre-vetted, licensed, and inspected. Compounding and retail options available
Securing patient data and building encryption infrastructure
HIPAA-compliant cloud infrastructure, end-to-end encryption, and breach response protocols built in
Executing and maintaining Business Associate Agreements
BAA executed as standard onboarding. Maintained as regulations evolve
Monitoring DEA requirements for controlled substances
Platform enforces DEA-compliant workflows where controlled substances are offered
Building HIPAA-compliant patient intake and consent flows
Pre-built, legally reviewed intake forms and e-consent workflows included

You don't need to become a healthcare compliance expert. You need a platform built by people who already are.

Compliance FAQ

The questions your attorney will ask. Answered.

Yes. Our infrastructure is built on HIPAA-compliant cloud services with signed Business Associate Agreements at every layer of the stack. We implement all required administrative, physical, and technical safeguards, including AES-256 encryption at rest, TLS 1.2+ encryption in transit, role-based access controls, complete audit logging, and documented breach notification procedures. We undergo independent third-party security assessments to verify our controls.
The platform is designed to separate your role as a brand operator from clinical decision-making. You are not practicing medicine. Licensed providers on the network make all clinical decisions independently. That said, we strongly recommend that every brand on the platform work with a healthcare attorney to structure their business appropriately. We provide guidance on recommended entity structures and insurance requirements, but we do not provide legal advice.
Telehealth laws vary significantly by state: prescribing rules, provider licensing requirements, controlled substance regulations, and patient consent requirements all differ. Our platform tracks these requirements and enforces state-specific workflows automatically. When a patient in Texas completes a consultation, the workflow follows Texas telehealth law. When regulations change, we update the platform so you don't have to monitor 50 different state boards.
The platform supports prescribing of certain controlled substances where permitted by state and federal law, including through providers with active DEA registrations. However, this is one of the most heavily regulated areas of telehealth. Not every state permits telehealth prescribing of controlled substances, and the rules change frequently. We enforce these restrictions at the platform level and work with legal counsel to stay current. We recommend discussing your specific product plans with your attorney before launching.
Patient data is protected health information (PHI) under HIPAA. It is stored in our HIPAA-compliant infrastructure, encrypted, and access-controlled. You, as the covered entity or business associate (depending on your business structure), maintain appropriate rights to PHI in accordance with HIPAA regulations and the terms of your BAA. We never sell patient data. We never use it for advertising. We never share it outside the treatment, payment, and healthcare operations purposes permitted by law.
We maintain documented incident response and breach notification procedures that comply with the HIPAA Breach Notification Rule. In the event of a qualifying breach, we will notify affected customers within the timeframes required by law, provide detailed documentation of the incident, and support the notification process to affected individuals and the Department of Health and Human Services as required.

Questions?

We take compliance seriously. Let's talk specifics.

Request early access and we'll walk through our compliance infrastructure in detail, including anything your legal team needs to review.

Request Early Access

Your patients' data is protected by the same infrastructure standards used by major health systems.

Request Early Access