Restricted access
Access to sensitive data is limited to authorized systems and people with a legitimate operational need.
Security controls
We use measures such as encryption in transit, infrastructure encryption at rest, monitoring, and least-privilege access where supported by the service.
Vendor configuration
A vendor offering HIPAA-eligible infrastructure does not by itself make every use of that infrastructure HIPAA compliant. Agreements, configuration, and operating practices also matter.
Data minimization
Share only what Gabriel needs for the task. Do not place health records, account credentials, or payment details in the public contact form or ordinary email.
Use the right channel
Keep sensitive records out of email.
Use the secure upload or signed-in product when it is available. The public contact form is for customer-service questions, not medical records. For an emergency, call 911 or your local emergency number.