HIPAA Compliance

Veterinary clinics are not directly subject to HIPAA, but we design OnDial with the same safeguards used in human healthcare. A detailed HIPAA-style controls summary is in progress; contact hello@ondial.me if you need the latest copy or a signed BAA-style agreement.

Data is encrypted in transit (TLS 1.2+) and at rest.
Secrets and API keys are stored in managed secret stores (Cloudflare Pages + Supabase).
Access to production data is limited to the core operator account with MFA enforced.
Every API request is logged with timestamp, actor, payload, and response for auditability.
Call recordings are not stored. Summaries keep only the structured data you configure.