Security and Compliance

Apothecare is designed to support organizations operating in regulated healthcare environments.

For customers that qualify as HIPAA covered entities or business associates, Apothecare may support the handling of protected health information subject to an executed Business Associate Agreement and appropriate implementation controls. Any HIPAA-related commitments apply only to the services, configurations, and workflows covered by the applicable agreement.

In addition to HIPAA, certain digital health products may also be subject to the FTC Health Breach Notification Rule, which can apply to health apps, connected devices, and similar technologies that are not covered by HIPAA.

Apothecare uses reputable cloud and infrastructure providers selected for their security, scalability, and operational resilience. We implement access restrictions, environment segregation, logging, and monitoring designed to reduce risk and support secure operations.

Core infrastructure protections include:

• Hardened cloud configurations with environment segregation
• AES-256 encryption at rest for database and file storage
• Automated daily backups with point-in-time recovery
• Our database and file storage run on Amazon Web Services under a Business Associate Agreement with AWS.

Account and sign-in emails are sent through Google Workspace under a Business Associate Agreement with Google.

Where third-party infrastructure providers are used, their security responsibilities are paired with Apothecare's own application, access, and operational controls under a shared responsibility model.

As a clinical AI platform, Apothecare takes special care with how patient data is processed by AI providers. Our AI architecture is designed with the following safeguards:

• Apothecare uses OpenAI API models for its AI features, under a Business Associate Agreement with OpenAI.
• Our OpenAI account is set to zero data retention for the API services we use. Apothecare does not use OpenAI's file storage, assistant, or stored-response features.
• AI-generated clinical content includes disclaimers and is always subject to practitioner review before clinical use

Apothecare is designed for dependable performance and ongoing service availability. We monitor production systems, investigate incidents, and maintain response procedures intended to support continuity of service. While no service can guarantee uninterrupted operation, we work to reduce downtime risk and restore service promptly when issues arise.

Customer Data

Apothecare stores and processes customer data in accordance with our contractual commitments, internal policies, and applicable law. Access to customer data is limited to authorized personnel with a business need.

Protected Health Information

If a customer elects to use Apothecare in workflows involving protected health information, we apply safeguards intended to support the confidentiality, integrity, and availability of that information. HIPAA-related use cases require appropriate contractual and technical implementation, including a Business Associate Agreement where applicable.

Encryption

Stored data is encrypted at rest using AES-256 encryption via our database and storage providers. These measures are intended to reduce the risk of unauthorized access to stored information.

Optional Analytics

With user consent, Apothecare uses Google Analytics to understand aggregate site and product-section usage. Analytics events are limited to coarse sections such as patients, labs, protocols, and query, and do not include patient identifiers, lab identifiers, portal slugs, clinical query text, or URL query strings.

Security is incorporated into the software development lifecycle. Our security practices include:

• Secret detection in the development pipeline.
• Input validation with schema enforcement
• Content Security Policy headers.
• CSRF origin validation
• Environment-specific testing before release
• Application access logging.
• Periodic security reviews of architecture and controls

We assess and prioritize remediation of identified vulnerabilities based on severity, exploitability, and potential impact.

Apothecare maintains procedures for identifying, investigating, containing, and remediating security incidents. We provide notices of security incidents and breaches as required by applicable law and our agreements.

We periodically review our security controls and prioritize fixes by severity. Where Apothecare states that it has achieved a certification or completed an independent audit, that statement applies only if expressly identified on this page or in customer documentation.

We take reports of security issues seriously and investigate credible submissions in a timely manner.

To report a suspected vulnerability, please contact: notifications@apothecare.ai

Please include:

• A clear description of the issue
• Affected URL, feature, or environment
• Reproduction steps
• Proof of concept, if available
• Your contact information for follow-up

We ask researchers to act in good faith, avoid privacy violations or service disruption, and allow us reasonable time to investigate and remediate before public disclosure.