The short answer

"Are you HIPAA compliant?" is one of the questions we get asked most, from users, practitioners and research partners alike. It's a fair question. You're trusting us with some of the most personal information you have.

The short answer: HIPAA doesn't formally apply to Human Health, so we don't claim to be HIPAA compliant. What we do is apply HIPAA-aligned privacy and security standards anyway, on top of being fully GDPR compliant. This post explains what that means and why we describe it that way.

What is HIPAA?

HIPAA is the US Health Insurance Portability and Accountability Act. It sets rules for how protected health information (PHI) is stored, shared and secured.

It applies to "covered entities" and their "business associates". Covered entities are healthcare providers, health plans and healthcare clearinghouses. Business associates are companies that handle PHI on their behalf.

Does HIPAA apply to Human Health?

Not today. You use Human Health directly, not through your doctor or health insurer, so we're neither a covered entity nor a business associate of one.

That's true of most consumer health apps, which is why "HIPAA compliant" on an app's website doesn't always mean much. We'd rather be precise. So instead of claiming compliance with a law that doesn't cover us, we say we're HIPAA aligned: we hold ourselves to the same kinds of standards voluntarily.

What "HIPAA aligned" means in practice

It means the safeguards HIPAA expects are part of how we build and run Human Health every day:

• Encryption: your personal and health information is stored encrypted at rest in Google Cloud Platform.
• Continuous monitoring: we use Vanta, a governance and compliance platform, to track our security controls and policies every day, not just once a year.
• Independent testing: every year we bring in a third party to run penetration testing. Ethical hackers simulate real attacks on our systems so we can find and fix weaknesses before anyone else does.
• Trained people: everyone on our team is trained in handling data and IT systems in line with GDPR, HIPAA and the security practices relevant to their role.
• Health data kept where it's needed: the systems that send our emails, run support chat or process payments never see what you've logged.

We're also fully GDPR compliant, one of the strictest data protection laws in the world. That gives you clear rights: you can request a copy of your data at any time and delete it easily.

And some lines we don't cross, whatever the law says. We never share your personal or health information with a third party without your explicit consent, and we don't use what you log about your health to target you with ads.

Why we no longer do an annual HIPAA audit

Until 2025, we also paid an independent firm for a yearly HIPAA assessment. After two rounds, we found it mostly reviewed our policy documents rather than how our app actually handles your data. Instead we're going to continue to put effort and energy into carefully designing and building our app, maintaining our security and compliance posture with Vanta, engaging expert external counsel to make sure we're handling data and consent in the right ways, and of course still doing yearly penetration testing.

Questions?

For the full detail, read our Privacy Policy or our post on privacy and security at Human Health. If you have a question we haven't answered, email support@human.health and we'll get back to you.