This page is a plain-language overview of how Unisona Health Inc protects Protected Health Information. It is not the contract. The binding commitments are in our Business Associate Agreement, which every customer organization enters into with us.
1Our role under HIPAA
Your organization is the covered entity. It holds the direct relationship with the patient, owns the medical record, and issues the Notice of Privacy Practices.
Unisona Health Inc is a business associate. We create, receive, maintain, and transmit PHI on your behalf in order to provide intake, clinical documentation, billing, revenue cycle, and workforce functions. We use PHI only to deliver those services, as permitted by the BAA, or as required by law.
Four commitments that do not change
- We never sell PHI and never accept remuneration in exchange for it.
- We never use PHI for marketing, fundraising, or advertising, ours or anyone else’s.
- We never use identifiable patient data to train models. Any model training uses data de-identified under HIPAA standards.
- Your records remain yours, and you can export them at any time.
3Administrative safeguards
- Security management process. A documented risk analysis is performed at least annually and after any significant change to the environment, with a tracked risk management plan.
- Assigned security responsibility. Named Security Officer and Privacy Officer accountable for the program.
- Written policies. Policies and procedures covering privacy, security, access management, incident response, sanctions, device and media controls, and contingency planning, reviewed at least annually.
- Business associate management. A signed BAA is in place with every subcontractor that touches PHI, imposing the same restrictions we accept.
- Information system activity review. Regular review of access reports, audit logs, and security incident tracking.
4Technical safeguards
| Control | How we implement it |
|---|---|
| Encryption in transit | TLS 1.2 or higher for all connections, with modern cipher suites and HSTS. |
| Encryption at rest | AES-256 for databases, object storage, and backups. |
| Access control | Unique named accounts, role-based permissions, and row-level authorization so records are scoped to the organization and program that owns them. Multi-factor authentication is [confirm: mandatory for all users / available on all accounts and enforceable at the organization level]. Multi-factor authentication is mandatory for Unisona Health staff accessing production systems. |
| Audit controls | Immutable, timestamped logging of record access, modification, export, and administrative changes, searchable by user, patient, and date range. |
| Integrity | Versioned clinical documentation with amendment history, signature attribution, and no destructive edits to signed notes. |
| Authentication | Password policy aligned to NIST SP 800-63B, credential-stuffing protection, rate limiting, and automatic session timeout. |
| Transmission security | Secure internal messaging, encrypted claim and lab exchange, and no PHI in email or SMS notifications. |
5Physical safeguards
Unisona Health Inc does not operate its own data centers. The platform runs on cloud infrastructure in United States data centers operated by Supabase, Amazon Web Services, and Vercel, and the physical controls described in this section — 24/7 staffing, biometric access control, video surveillance, and environmental protection — are theirs, not ours. The other subprocessors listed in Section 9 run their own facilities, and each one that receives PHI is bound by a business associate agreement with us.
Whose certifications these are
The SOC 2 Type II and ISO 27001 certifications covering those facilities are held by those infrastructure providers. They are not Unisona Health Inc certifications, and nothing on this page should be read as Unisona Health Inc holding them. Our own certification status, including what is complete and what is still in progress, is published on the Trust Center.
- All PHI is stored and processed within the United States. We do not transfer PHI offshore.
- Workstation security. Company devices are encrypted, centrally managed, screen-locked, and remotely wipeable.
- Media disposal. Decommissioned media is cryptographically erased or destroyed by the infrastructure provider under certificate.
6Substance use records under 42 C.F.R. Part 2
Stricter than HIPAA
Records from a federally assisted substance use disorder program carry protections beyond HIPAA. Most disclosures require written patient consent, redisclosure is prohibited without further consent, and the records generally cannot be used in legal proceedings against the patient without a court order.
The platform is built with these rules in mind:
- Consent capture and expiry tracking, so a disclosure cannot be made under a lapsed consent.
- Program-level segmentation, so Part 2 records are visible only to staff with a role that permits it.
- The required prohibition-on-redisclosure notice attached to qualifying disclosures.
- Disclosure logging that supports the accounting obligations introduced by the CARES Act alignment of Part 2 with HIPAA.
Determining whether your program is subject to Part 2, and obtaining valid consent, remains your organization’s responsibility. We provide the mechanism; you make the determination.
7Minimum necessary
We limit our request, use, and disclosure of PHI to the minimum necessary to accomplish the purpose. In practice that means engineering and support staff do not have standing access to customer records.
- Production access requires an approved, time-boxed request tied to a specific support ticket or incident.
- Every access is logged, attributed, and reviewed.
- Non-production environments use synthetic or de-identified data. Production PHI is never copied into development or test systems.
8Workforce and training
- Background checks before hire, to the extent permitted by law.
- Signed confidentiality agreements covering PHI for all personnel and contractors.
- HIPAA and security awareness training at onboarding and annually, with role-specific training for engineering and support, plus phishing simulation.
- A documented sanction policy, up to and including termination, for violations.
- Access is revoked as part of the offboarding checklist on the last day of employment.
9Subprocessors
These are the subprocessors that may process customer data. Each one that receives PHI has signed a business associate agreement imposing the same obligations we accept. This is the same list published on the Trust Center, and it is the list our Business Associate Agreement incorporates by reference.
| Vendor | Function | Receives PHI | BAA in place | Location |
|---|---|---|---|---|
| Supabase | Database, authentication, and file storage | Yes | Yes | United States (AWS us-east-1) |
| Amazon Web Services | Underlying infrastructure | Yes | Yes | United States (us-east-1) |
| Vercel | Application hosting and content delivery | Yes | Yes | United States |
| Twilio | Programmable Video for telehealth sessions, and two-way SMS including appointment reminders | Yes | Yes | United States |
| Twilio SendGrid | Transactional email, including website enquiry notifications and [patient appointment reminders? – confirm] | [Confirm] | [Confirm] | United States |
| Claim.MD | Clearinghouse: claims, ERAs, and payer enrollment | Yes | Yes | United States |
| Weno | E-prescribing and pharmacy directory | Yes | Yes | United States |
| Fax.Plus | Inbound and outbound fax | Yes | Yes | United States |
| Stripe | Subscription billing, and patient payments: payment links, cards on file, and payment plans | Yes | Yes | United States |
| Bunny.net | Video hosting for training and CLAS therapy content | No | N/A | United States |
| [AI vendor – name] | Dictation and writing assistance | Yes | Yes, with zero data retention | [United States – confirm] |
Integrations you enable
Some of the vendors above sit behind integrations you switch on in the admin portal. These run under vendor accounts that Unisona Health Inc holds rather than credentials you supply, which is why they appear in the table as our subprocessors: we sign the downstream business associate agreement, and the vendor is bound by the same obligations. Enabling an integration authorizes that specific disclosure; leaving it off means no data is shared with that vendor.
If you would rather contract with a vendor directly under your own agreement, tell us and we will confirm whether that integration supports customer-supplied credentials. We will give customers at least 30 days notice before adding a subprocessor that will handle PHI. To receive those notices, email security@unisonahealth.com.
10Analytics and PHI never mix
Website analytics is a common source of accidental PHI disclosure across the industry — typically when a tracking script is left running on an authenticated page and captures a URL, form field, or on-screen record.
How we prevent it
- Google Analytics, Vercel Web Analytics, Microsoft Clarity, and the Meta Pixel load only on the public marketing website (www.unisonahealth.com). The Unisona Health Inc application runs no analytics, advertising, or tracking tools on any of its domains — app.unisonahealth.com, clinic subdomains, or custom domains.
- All of them are blocked until a visitor opts in through the consent banner, and the Meta Pixel and Google Ads need their own, separate Advertising consent.
- Clarity runs with text input masking enabled, so typed content is not recorded.
- Google Analytics runs with advertising identifiers, Google Signals, and remarketing disabled unless the visitor also opts in to Advertising. The Meta Pixel and Google Ads are advertising tools: for visitors who opt in, they measure our ads and can build ad audiences from visits to marketing pages, which is why they are off by default and never run where PHI could be present.
- Application URLs never contain patient identifiers in query strings that could leak through a referrer header.
These vendors serve only the marketing website and receive no PHI, so they are not subprocessors of customer data and are listed here rather than in Section 9:
| Vendor | Function | Consent needed | PHI |
|---|---|---|---|
| Google (Analytics) | Aggregate traffic measurement | Analytics | No |
| Vercel (Web Analytics) | Cookieless page-view counts | Analytics | No |
| Microsoft (Clarity) | Heatmaps and session replay | Analytics | No |
| Meta (Pixel) | Advertising measurement and ad audiences | Advertising, separately | No |
| Google (Ads) | Advertising measurement and ad audiences, through Google Analytics | Analytics and Advertising | No |
Full detail on what these tools collect is in our Privacy Policy.
11Breach and incident response
We maintain a documented, tested incident response plan. Our contractual notification commitments are:
Our report will include, to the extent known:
- What happened, and the date of the incident and of discovery.
- The categories of PHI involved and the individuals affected.
- What we have done to investigate, mitigate, and contain the incident.
- Steps we recommend you take, and what we are doing to prevent recurrence.
You remain responsible for the notifications required under the HIPAA Breach Notification Rule to affected individuals, the Secretary of Health and Human Services, and where applicable the media. We will provide the information and cooperation you need to make them.
Suspect an incident? Contact security@unisonahealth.com immediately. We monitor this address continuously.
12Supporting patient rights
Patients exercise their HIPAA rights through your organization, not through us. Where we hold PHI in a Designated Record Set on your behalf, we support you within these timeframes:
13Backup, recovery, and continuity
- Automated encrypted backups with point-in-time recovery.
- Geographically separated backup storage within the United States.
- Restore procedures tested at least annually.
- A documented contingency plan covering data backup, disaster recovery, and emergency mode operation so clinical staff retain access to records during a disruption.
14Assessments and audits
- Annual HIPAA Security Rule risk analysis with a tracked remediation plan.
- Continuous dependency and vulnerability scanning with defined remediation windows.
- Annual review of all policies, procedures, and subprocessor agreements.
- Third-party penetration testing of the application and infrastructure is scheduled, and will run annually once the first test is complete. No penetration test attestation is available yet.
Customers and prospective customers under NDA may request our current security documentation package, including the risk analysis summary and policy index, by emailing security@unisonahealth.com. Items still in progress, including the penetration test attestation and the SOC 2 Type II report, are tracked on the Trust Center and will be added to the package once they exist.
15Requesting a Business Associate Agreement
A BAA is required before any PHI enters the platform. Our standard Business Associate Agreement is entered into when your account is created, and it covers the great majority of customers without modification.
If your organization requires its own BAA form, or negotiated terms, email legal@unisonahealth.com with the document and we will review it. We will not accept PHI until a BAA is executed.
16Report a concern
Security and privacy contacts
Unisona Health IncSecurity incidents: security@unisonahealth.comPrivacy questions: privacy@unisonahealth.com
Legal and BAAs: legal@unisonahealth.com
Security researchers are welcome to report vulnerabilities to security@unisonahealth.com. Please do not access, modify, or exfiltrate any data that is not your own, and give us a reasonable opportunity to remediate before disclosure. We will not pursue action against researchers who follow these guidelines in good faith.
You may also file a complaint with the HHS Office for Civil Rights. We do not retaliate against anyone who files a complaint.
17Revision history
- Version 3.3. Added Google Ads to the marketing website's vendor table. It works through Google Analytics, runs only on the public marketing website, and only for visitors who opt in to both analytics and advertising.
- Version 3.2. Replaced the two-vendor subprocessor table with the complete list, now shared with the Trust Center, showing for each vendor whether it receives PHI, whether a business associate agreement is in place, and where it processes data. Removed the separate integration list, whose vendors now appear in that table. Named the infrastructure providers in the physical safeguards from the same list. Aligned the multi-factor authentication and model training statements with the Trust Center and the Business Associate Agreement.
- Version 3.1. Moved the marketing website's analytics and advertising vendors out of the subprocessor list into their own table in the analytics separation policy, and added Vercel Web Analytics and the Meta Pixel to it. The Meta Pixel runs only on the public marketing website, and only for visitors who opt in to advertising. Stated that the Unisona Health Inc application runs no analytics, advertising, or tracking tools on any of its domains.
- Version 3.0. First publication of this overview as a standalone page, separated from the legal text of the BAA. Adds the shared responsibility model, the control inventory, 42 C.F.R. Part 2 handling, the subprocessor list with a 30-day change notice, the analytics separation policy, and the assessment schedule.