Security & Trust Center

01 / BUYER DUE DILIGENCE

Architecture and information separation

The public marketing website runs independently of restricted SaaS and care-transition infrastructure. Public resource pages are not a gateway into a private patient database, and public business contact must stay outside clinical processing.

• Our public pages, educational links and news monitor are informational; external agency content remains with its original publisher.
• The protected product environment is not an automatic extension of a public form or directory page.
• A technical prototype and passing synthetic tests do not demonstrate authorization to process real patient information.

02 / BUYER DUE DILIGENCE

Information accepted through public channels

General contact and pilot-interest channels are intended for professional business inquiries. Directory correction and organization-registration pathways have separate review purposes. The privacy notice explains the actual business fields and correction/deletion contact.

• Do not provide patient or resident names, clinical records, diagnoses, discharge packets, insurance details or individual placement requests.
• Organization name, work contact information, location and high-level business interests may be reviewed for legitimate business follow-up.
• Business contact records require appropriate access, retention and deletion decisions; final attorney-reviewed retention terms are still pending.

03 / BUYER DUE DILIGENCE

Current safeguards and what they do not prove

The public site uses HTTPS, first-party publishing assets, source-aware links, and separates protected portals from search indexing. These are useful layers, but they are not a substitute for a formal security assessment or a documented product-wide control audit.

• A protected login page does not establish independent penetration testing or contractual compliance.
• SEO noindex directives are discovery controls, not authorization barriers; private functions must enforce authentication and role checks separately.
• No SOC 2 certification, HIPAA compliance determination, penetration-test attestation or customer data-processing agreement is claimed on this page.

04 / BUYER DUE DILIGENCE

Controls that must be assessed for restricted workflows

Before enabling sensitive care coordination, the intended purpose and applicable law must be documented, including any HIPAA, 42 CFR Part 2 or California privacy obligations. Scope depends on the actual organizations, data and service contracts.

• Confirm vendor agreements and any required BAAs or other written contracts for the specific use.
• Test tenant isolation, minimum-necessary access, authentication, audit logs, encryption configuration, backup and recovery, retention and incident procedures.
• Evaluate source licensing, permitted publication, integrations, consent and human review before any real referral or patient data flows.

05 / BUYER DUE DILIGENCE

Availability, support and operational assurances

This public website does not advertise a binding uptime SLA, recovery-time objective, support response target, independently audited disaster recovery, or general SaaS subscription terms. Such commitments must be defined and supported by evidence before they are offered.

• Public website availability is not a guarantee of future care-product uptime.
• Neither the demonstration screens nor the pilot-interest confirmation create paid membership, authorization or a service agreement.
• Organizations should request current commercial and technical terms directly before making procurement decisions.

06 / BUYER DUE DILIGENCE

Questions for security and procurement reviewers

A constructive review can start with business purpose and data categories, then request the evidence appropriate to the proposed deployment. Ask which features are genuinely live, who controls identity and access, and who is accountable if records or providers change.

• Which legal entity and vendors will process each data category, and under what written agreement?
• Which systems hold business contacts versus restricted data, and what are the deletion and access paths?
• Which integrations, source rights, resilience controls and privacy/security assessments have been independently verified for the intended use?

NEXT STEPS

Continue your evaluation

• Read our public privacy notice
• See pilot information boundaries
• View the platform capability and readiness matrix
• Read website terms
• Contact the business team