Your patients' data, handled like it matters.
Medical coding means handling protected health information. Here is how we do it.
Business Associate Agreement first
For customers, a BAA is signed before we receive any protected health information. The free E/M calculator is not covered by a BAA and takes de-identified notes only.
Minimum necessary access
We access only the encounter data needed to code it, through the access your practice grants.
No training on your data
Your patients' information is used to code your encounters and for nothing else.
Synthetic data in demos
Our product tour and sales demos use synthetic patients and charts only.
Controls in place
What protects the data today.
- Encryption
- Encrypted in transit with TLS 1.2 or higher. Stored notes and results are encrypted at rest, with an application-level key on top of the database's own storage encryption.
- Access control
- Production systems are reachable only by named team members. Our app's sign-in is rate-limited and locks after repeated failed attempts, and sessions expire.
- Audit logging
- Every signed-in action in our app is written to an append-only audit log.
- Retention and deletion
- Free calculator: the note is deleted as soon as the calculation finishes, and results are deleted after 30 days. Customers: retention, return and destruction of PHI are set in your BAA.
- Incident response
- If we discover a breach of your protected health information, we notify you as HIPAA and your BAA require.
Subprocessors
The providers that run our service, and how each handles data.
| Provider | Used for | Data handling |
|---|---|---|
| Google Cloud | Application hosting and processing | Business Associate Agreement in place |
| MongoDB Atlas | Database | Business Associate Agreement in place |
| Cloudflare | Website delivery and network protection | Carries encrypted traffic; stores no patient data |
Request our security documentation
Send us your vendor security questionnaire or ask for our documentation. We'll answer it before you sign.
Request documentationSee how your encounters would be coded.
A 30-minute walkthrough, then a validation plan on your own charts: what we connect, how we measure, and what it costs.