Your health data, treated like health data.
Allostatic connects the full record of how you move, wearables, records, life events. That only works if it's private and secure to the standard health data deserves. Here is exactly how we protect it.
HIPAA-compliant by design
Your movement and health data is protected health information, and we treat it that way. Every part of the system that stores, moves, or analyzes your data is built to the HIPAA Privacy and Security Rules.
Protected by Business Associate Agreements
Your protected health information flows only through HIPAA-eligible infrastructure under Business Associate Agreements: Google Cloud (Firebase), which runs our database and authentication, and Amazon Web Services (Bedrock), which runs our AI analysis inside a HIPAA-eligible, isolated environment. We do not open Allostatic to the public until every agreement covering your data is signed and in force.
We never train AI on your data
Your data is never used to train, fine-tune, or improve any model, ours or a provider's. Analysis runs with zero data retention on the model side: your information is used to answer your question and nothing else.
Encrypted in transit and at rest
Everything is encrypted over the wire with modern TLS and encrypted at rest with AES-256. Your data is never sitting or traveling in the clear.
Designed around SOC 2 control principles
Our infrastructure and internal processes are designed around the SOC 2 control principles for security, availability, and confidentiality: least-privilege access, logging of access to protected health information, and encrypted, access-controlled backups.
Your data belongs to you
You can export or permanently delete your data at any time. We don't sell it, we don't share it for marketing, and we don't run ads. Our only business is the analysis you ask for.
- Least-privilege access, staff and clinicians only see the data they need
- Clinician access is scoped per patient, a clinician only sees the people assigned to them
- Access to protected health information is logged
- Data hosted in the United States
- Encrypted, access-controlled backups with tested recovery
- A written incident-response and breach-notification plan