We built Upheal to protect what matters most: your confidential therapeutic relationships. Your clients' vulnerable moments remain exactly where they belong: within the therapeutic container you've carefully created.
Unlike typical AI scribes, Upheal never uses your sessions to train our platform without explicit permission from you and your clients.
We empower your clients with clear choices about their data privacy, including opt-out options that respect their therapeutic autonomy.
We've built a privacy policy that never allows selling your clients' sensitive information to third parties or data brokers.
If subpoenaed, we’ll contact you first (if allowed), upholding your role as the guardian of client confidentiality.
We’re SOC 2 certified, meaning independent auditors continuously find that our team handles your data with this highest standard of privacy practices
We invest in regular penetration testing by external security experts, following rigorous OWASP standards to protect your practice.
Yes. The Upheal platform empowers healing professionals to concentrate on their services by offering automated notes and analytics for client conversations. As a part of this process, Upheal handles protected health information for practitioners, adhering to HIPAA regulations as a Business Associate.
Upheal fully complies with the HIPAA Security Rule and Privacy Rule, ensuring that clients’ electronic health information (ePHI) is protected with proper administrative, physical, and technical safeguards to ensure confidentiality, integrity, and security.
Our platform provides a secure environment for your ePHI through a combination of technical and nontechnical measures. Learn more here.
Yes. We have undergone an assessment by a 3rd party auditor which confirmed we are meeting all requirements set by the Personal Health Information Protection Act (PHIPA) and the Personal Information Protection and Electronic Document Act (PIPEDA).
This means that whether you're using our product across Canada or in the province of Ontario, your data remains under the safeguard of the highest privacy protocols.
Yes. Upheal is fully compliant with the General Data Protection Regulation (GDPR), UK GDPR, and UK Data Protection Act (DPA). We prioritize the privacy and protection of our users' personal data, ensuring that all data processing activities are carried out in accordance with the stringent requirements set forth by these regulations.
At Upheal, we are committed to protecting the data on our platform and have therefore implemented several measures to ensure its security. We understand that trust is critical in our industry, and we are therefore committed to protecting our customers' data:
Our systems regularly undergo comprehensive penetration testing by external security firms, following industry-leading OWASP standards. All issues are addressed, and tests are reported in our Trust Center.
Yes. You can find our Business Associate Agreement (BAA) here which governs our cooperation between us as a Business Associate and healing professionals when they are defined as a Covered Entity under HIPAA. All Covered Entities who use our platform agree to the terms of the BAA upon signing up.
Personal data including protected health information (PHI) processed by the Upheal platform is stored in a pseudonymized format. This means that personal data is not stored in its original form but is instead replaced with a pseudonym or a random identifier. This process ensures that personal data is not directly identifiable, reducing the risk of unauthorized access to sensitive information.
Upheal only accesses a client’s protected health information (PHI) when it’s necessary in investigating a technical issue that a care provider reports to Upheal Support. Most technical problems are solved without any access to PHI, but sometimes, we need to see some details to understand exactly what went wrong. The Upheal Support team who may access PHI are HIPAA-trained engineers and act in line with our SOC 2 Type II attestation. They do not share, sell, or expose your data to others.
Access to personal data is strictly controlled and limited to individuals who require access to perform their job functions. All access to personal data is logged and monitored, and access rights are reviewed regularly to ensure that they are appropriate and up-to-date.
Yes, we offer various methods to collect client consent through the app. It can be shared via email or directly during the call. For more details about the consent collection process, you can visit the support center. Additionally, you can check this Privacy Policy template.
Your clients trust you with their most vulnerable moments, and you deserve supportive technology that honors that trust as seriously as you do. When you're choosing a tool, ask the difficult questions, read the privacy policies, and demand transparency.
