Compliance & Security
How SCAIP™ handles security, privacy, HIPAA alignment, and operational resilience — built to healthcare-industry standards.
Important — Test Data Only
This platform is built to HIPAA standards. However, no real Protected Health Information (PHI) may be processed until formal HIPAA certification, signed Business Associate Agreements, and a designated compliance officer are in place. Until then, only fictional/test data is used for validation and demonstration.
Built to Industry Healthcare Standards
Drawing on expertise from healthcare-focused software organizations like Arkenea, Taction Software, and Medical Web Experts.
Production Hosting & Infrastructure
- Hosted on Base44 cloud infrastructure with managed scaling, automatic failover, and 99.9%+ uptime targets.
- All traffic encrypted end-to-end via TLS 1.3; HTTP strictly enforced with HSTS headers.
- Environment separation: production, staging, and development — never live data in non-production environments.
- Content delivery via global CDN with DDoS protection and rate limiting at the edge.
Security Architecture
- Role-based access control (RBAC) with least-privilege defaults — users see only data their role permits.
- Row-Level Security (RLS) on every entity: parents see only their own family data; professionals see only their assigned clients.
- Authentication via OAuth 2.0 with short-lived access tokens and secure refresh rotation.
- All secrets (API keys, integration credentials) stored in encrypted vault — never hardcoded or logged.
- Input validation and output encoding on every form and API endpoint to prevent injection attacks.
HIPAA Compliance Approach
- SCAIP™ is designed to support HIPAA-aligned workflows: technical, administrative, and physical safeguards are documented here.
- Business Associate Agreements (BAAs) must be signed with every third-party processor before any Protected Health Information (PHI) flows through it.
- PHI fields are minimized at collection — we store only what is necessary for the service to function.
- All PHI access is logged with user identity, timestamp, and action for audit trail purposes.
- Automatic session timeout after 15 minutes of inactivity on authenticated sessions.
- Status: The platform is built to HIPAA standards. Formal HIPAA certification, signed BAAs, and a compliance officer must be in place before any real PHI is processed. Until then, only fictional/test data is permitted.
Privacy & Legal Documentation
- Privacy Policy: explains what data is collected, how it is used, retention periods, and user rights including access, correction, and deletion.
- Terms of Service: defines acceptable use, liability limitations, and user responsibilities.
- HIPAA Notice of Privacy Practices: available before any PHI is collected, as required by 45 CFR 164.52.
- Cookie and tracking disclosure with explicit consent banners where analytics or tracking are active.
- GDPR Data Protection notice for EU/EEA/UK/Swiss users, including data subject rights and a data subject request form.
- All policies version-controlled with effective dates and available in the footer of every page.
Organization Policies
- Acceptable Use Policy: defines permitted and prohibited platform activities.
- Data Retention Policy: specifies how long each data category is kept and the deletion process.
- Incident Response Policy: escalation paths, severity definitions, and notification timelines for security incidents.
- Access Management Policy: onboarding, role changes, and offboarding procedures for staff and professionals.
- Information Security Policy: password requirements, MFA mandates, and device management rules.
User Support
- Tiered support model: self-help knowledge base, in-app AI assistant, and human support escalation.
- Account recovery via verified email and phone — never sharing data over unverified channels.
- Support staff access is role-scoped and auditable; no blanket access to PHI.
- All support interactions logged for quality assurance and compliance review.
Security Testing
- Automated dependency vulnerability scanning on every build and deployment.
- Static application security testing (SAST) to catch code-level vulnerabilities before release.
- Periodic penetration testing against staging environments before any production change.
- OWASP Top 10 review on all form submissions and API endpoints.
- Tabletop exercises for incident response readiness, conducted at least quarterly.
Business Continuity & Backups
- Automated daily backups of all database entities with point-in-time recovery.
- Backups encrypted at rest with separate key management — not accessible via application credentials alone.
- Recovery Time Objective (RTO): under 4 hours; Recovery Point Objective (RPO): under 24 hours.
- Geo-redundant storage so a regional outage does not result in data loss.
- Documented disaster recovery runbook tested semi-annually.
Ongoing Maintenance
- Dependency updates and security patches applied within defined SLA windows (critical: 48 hours, high: 7 days).
- Scheduled maintenance windows communicated to users in advance; no unannounced downtime for live services.
- Database schema migrations reviewed for backward compatibility and tested in staging before production rollout.
- Technical debt tracked and addressed in regular development cycles.
Deployment & Monitoring
- CI/CD pipeline with automated tests; deployments gated on failures.
- Real-time monitoring of uptime, response times, error rates, and database performance.
- Security alerting for anomalous access patterns, brute-force attempts, and unauthorized PHI reads.
- Centralized logging with structured, searchable logs (PII redacted at ingestion).
- Status page maintained for transparency during incidents and planned maintenance.
Role-Based Access for Every Stakeholder
Account types under development to support the full healthcare ecosystem.
Parent Accounts
Families manage child profiles, roadmaps, documents, and messages.
Professional Accounts
Therapists, educators, and service providers manage assigned clients and referrals.
School Accounts
Schools manage IEP coordination, student supports, and staff access.
Hospital Accounts
Hospitals manage diagnostic referrals, care teams, and institutional reporting.
Features in Development
Internal Policy Documents
Draft Privacy Officer, Breach Response, and Data Retention policies for internal review.
View Internal PoliciesData Protection (GDPR)
EU/EEA/UK data subject rights, lawful basis, data transfers, and a request submission form.
View GDPR NoticePre-Deployment Checklist
Before any real PHI is allowed on the platform: (1) HIPAA certification finalized, (2) signed BAAs with all processors, (3) compliance officer appointed, (4) penetration test passed, (5) privacy policies published and linked in the footer, (6) incident response runbook documented, and (7) all test data purged from production.