Your Trust, Our Foundation
Every piece of data, every interaction, every visit — protected by enterprise-grade security and full HIPAA compliance. Conci is built on trust.
Learn About Our ServicesSecurity Features
Enterprise-grade protection at every layer of our platform.
HIPAA Compliant Infrastructure
Cloud infrastructure on Google Cloud Platform (US regions) under an executed Business Associate Agreement. Encrypted at rest and in transit. Our controls are mapped to the SOC 2 Trust Services Criteria; an independent SOC 2 audit has not yet been performed.
Encryption in Transit and at Rest
TLS 1.3 for all communications in transit. Full-disk encryption for all storage, with application-level AES-256-GCM on the most sensitive fields — authentication secrets and personal-tier assistant data.
Row-Level Security
Every database query is scoped to the organization. 277 tables protected by row-level security, with FORCE enabled on every one — exact parity, no exceptions, verifiable from our migration history. Cross-tenant access is blocked at the database rather than in application code, and every new table is gated on it in CI.
Role-Based Access Control
Deny-by-default authorization model. Four role tiers: Superuser, Admin, Triage, Provider. Providers only see what they need. Fine-grained permission scoping.
Audit Trails
Security-sensitive and clinical actions are written to an append-only audit log that cannot be edited or deleted — enforced by the database itself — with a hash chain verified on a schedule. Consent records are immutable. We are extending audit coverage across every state-changing endpoint.
Privacy by Design
Cookie consent management (ConciTrust). CCPA Do Not Sell compliance. Global Privacy Control (GPC) auto-detection. Transparent opt-out mechanisms.
Module-Level Security
Every module is built with security as a core requirement.
ConciSign
HIPAA-aligned e-signatures with immutable signing records and complete audit trails. Cryptographic PKCS#7 document sealing is available and enabled per organization.
- ESIGN Act & UETA compliant
- Tamper-evident seals
- Immutable records
- Audit trail logging
ConciChart
Clinical documentation with provider-only access, signed notes that cannot be altered, and addendum-only corrections.
- Provider-scoped access
- Signed, immutable notes
- Addendum-only modifications
- Complete audit logs
ConciTrust
Cookie consent and privacy management with CCPA compliance, automatic GPC signal detection, and transparent opt-out.
- CCPA/CPRA compliance
- GPC auto-detection
- Granular consent
- Transparent tracking
ConciYou
AI assistant with three-tier data classification, MFA for personal data access, and per-user encryption.
- Data classification tiers
- MFA protection
- Per-user encryption
- Audit logging
Standards We Build To
The frameworks and statutes our platform is designed and operated against. Our controls are additionally mapped to the SOC 2 Trust Services Criteria; an independent SOC 2 audit has not yet been performed.
HIPAA
Health Insurance Portability and Accountability Act
CCPA/CPRA
California Consumer Privacy Act
ESIGN & UETA
Electronic Signatures Compliance
GPC
Global Privacy Control
Data Storage & Privacy
Clear, honest answers about where your data lives and how we protect it.
Where Your Data Lives
The patient medical record is stored in Google Cloud Platform US regions only. We do not replicate the record internationally, and all storage is encrypted at rest. A small number of integrations — messaging, mapping and calendar — receive limited data in order to deliver care; each is covered by a vendor agreement we track and review.
Data Ownership
Your data belongs to you. Patients have the right to a copy of their complete medical record and to request its deletion. Contact us and we respond within the timeframes HIPAA and CCPA require.
No Data Sales
We have never sold, and will never sell, patient data to third parties. We do not monetize your health information. Your trust is our highest priority.
Regular Audits
We conduct regular security audits and penetration testing by third-party experts. Our infrastructure undergoes continuous compliance monitoring and improvement.
Our Security Principles
Privacy by Default
Every new feature is designed with privacy as a first-class requirement, not an afterthought.
Least Privilege
Users receive only the access they need. Permissions are denied by default and granted explicitly.
Audit Everything
Every action on sensitive data is logged with full context. Logs are retained and regularly reviewed.
Transparent Operations
We tell you how your data is used, stored, and protected. No hidden practices or surprise terms.
Ready to experience care you can trust?
Book your first visit with Conci and experience urgent care without compromise.
Book a Visit