Ovea Clubby AutoAppointSet up your clinic

HIPAA and security

How we protect patient information.

Clinics trust us with their patients. This page lists what we do about it. Our Business Associate Agreement is public, and clinics can ask for security answers at any time.

Business Associate Agreement

Every clinic signs our Business Associate Agreement in the admin before patients join, and can download the signed copy any time. Vendors that store or send protected health information for us, such as hosting, database and message delivery, must sign a BAA with us that carries the same protections. Stripe processes card payments for clinics under HIPAA's payment processing rules and never receives treatment details from us.

Where data lives

Patient data, backups and logs are stored in the United States, in Amazon Web Services us-east-1 (Northern Virginia). They are not copied to other regions.

Safeguards

  • Encryption: TLS 1.2 or newer for every connection. Databases, backups and logs are encrypted at rest with keys we manage in AWS KMS. Patient emails and names are also encrypted inside the database, with a separate key.
  • Minimum necessary: the app holds what clinics need to run memberships and rewards. Prescription programs are listed but never discounted or promoted. Sign-in emails contain only a code.
  • Access control: clinic staff see only their own clinic. Our team uses named accounts with multi-factor authentication and no shared passwords. Server access goes through logged sessions, not open SSH.
  • Audit logs: sign-ins, joins, point changes, bookings, payments and every view of a patient list are logged, cannot be edited, and are kept for six years.
  • Network: the database has no internet access and only accepts connections from the app server.
  • Backups: daily, encrypted, with point-in-time restore.
  • Updates: security patches are applied automatically.

People and process

  • Annual HIPAA training for everyone with access, and access reviews every quarter.
  • A yearly risk assessment and written security policies.
  • Incident response: we notify affected clinics without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information, with what we know and what we are doing about it.

Report a problem

Found a security issue? Email security@joinovea.club. We reply within two business days.

Last updated November 3, 2026. Questions: privacy@joinovea.club