Privacy and security
Your visits are private. Here is how we protect them.
A recorded doctor’s visit is one of the most personal things you can keep anywhere. This page explains, in plain words, how Lenaya Health protects it.
Our standard
HIPAA doesn’t cover us. We use it as our yardstick anyway.
HIPAA is the federal law that protects the health records held by most doctors, hospitals and health insurers, and by the companies working for them. Lenaya Health isn’t one of those: we work for you, not for a doctor or an insurer, so HIPAA doesn’t apply to us.
We didn’t think that was a good reason to do less. So we use HIPAA’s Security Rule — the part that says how health information must be protected — as the yardstick for how we build and run Lenaya. Each protection below names the HIPAA idea it relates to.
We don’t call ourselves “HIPAA compliant” or “HIPAA certified.” There is no official HIPAA certification, and a badge suggesting that HIPAA covers us would mislead you. The laws that do apply to us include the Federal Trade Commission’s Health Breach Notification Rule and state health-privacy laws such as Washington’s My Health My Data Act.
How we protect it
Six protections, in plain words.
You control your Care Circle
Family, friends and caregivers can see your visits only if they are invited into your Care Circle. You choose whether each person can only view your visits or can also record visits and add documents for you, and you can change that, or remove them, at any time.
Related HIPAA safeguard · Access control
No password to steal
You sign in with your Google account, so we never create or store a password for you. On iPhone, your sign-in is kept in the phone’s secure Keychain, locked to that one phone. In a web browser, it is cleared when you close the tab.
Related HIPAA safeguard · Authentication
Encrypted on the way and where we keep it
Everything travels between your device and our servers over encrypted connections. Once uploaded, your recordings, transcripts, summaries and documents are encrypted where we store them, too.
Related HIPAA safeguard · Transmission security & encryption
Kept off the open internet
Your records are kept in a database and file storage that are closed to general access from the open internet. The Lenaya app connects to them over a private network.
Related HIPAA safeguard · Access control
A security log
Sign-ins, failed sign-in attempts and other important events on your account are recorded, and we keep that log for six years.
Related HIPAA safeguard · Audit controls
Visit notifications never say what was said
When a visit is ready, the notification says just that. Your visit details stay inside the app, behind your sign-in.
Related HIPAA principle · Minimum necessary
Not for sale
Your information is never the product.
- We never sell your information. Not to advertisers, not to data brokers, not to anyone.
- We never use your recordings, documents or health information to train AI models. The services that run Lenaya for us are not allowed to train their own models on it either.
- No ads, and no code that tracks you across other websites or apps.
Your records, your call
Take it with you, or take it away.
- Download your records. From the web app, you can download a copy of your transcripts, summaries and documents.
- Delete a visit, or your whole account. Most of it is removed right away. Some derived data, and our routine encrypted backups, clear within about three weeks. The Privacy Policy explains what is kept and why.
Behind the scenes
We put it in writing.
HIPAA expects more than good software. It expects someone to be accountable, and a plan for when things go wrong. We keep these in writing:
- A named person responsible for security, accountable for every decision about protecting your information.
- A written risk analysis of what could go wrong and what we do about it.
- A list of the companies that handle your information, what each one receives, and the contract that covers it.
- A plan for the unexpected. We keep a written plan for handling security problems, including how we would contact you if one ever affected your information.
Related HIPAA safeguards · Administrative
The people you record
Their privacy matters too.
A visit includes your clinician, and sometimes a family member. Recording laws vary by state, and some require everyone in the room to agree. Our Terms ask you to tell everyone present that you are recording with Lenaya Health and that software will process the recording — and to stop if anyone asks.
Questions about your privacy?
Read the full policy, or write to us.