We use essential cookies to make our site work. With your consent, we may also use non-essential cookies to improve user experience and analyze website traffic. By clicking “Accept,” you agree to our website's cookie use as described in our Cookie Policy. You can change your cookie settings at any time by clicking “Preferences.”
KinBridge Health AI

HIPAA Notice & Security Posture

KinBridge Health AI is designed under HIPAA Security Rule safeguards. This page summarizes how we protect protected health information (PHI); for the binding contract terms see our Privacy Policy and Terms & Conditions.

Administrative safeguards

  • Signed Business Associate Agreements (BAAs) with the subprocessors that hold or process PHI: AWS, Google Cloud, OpenAI, Anthropic and MongoDB. Where an agreement with a vendor is still pending, we do not treat that as permission to handle information less carefully.
  • Least-privilege role model in every workspace — primary caregiver, caregiver, aide, family, viewer.
  • Access audit trail persisted for six years for every staff and support view of PHI.

Technical safeguards

  • TLS 1.2+ in transit, AES-256 at rest on both database and object storage.
  • JWT session tokens revocable per-device; sessions terminate immediately on caregiver revoke.
  • Support agents cannot view a patient's name, DOB, or address until they complete a caller-verification challenge for that specific family (30 min window, 5-attempt lockout).
  • Per-patient siloing — a paid aide only sees the loved one they're assigned to.

Physical safeguards

  • All infrastructure hosted in SOC-2-audited US data centers.
  • Mobile audio recordings stay on-device unless the caregiver explicitly shares them.

Breach notification

In the rare event of a PHI breach, KinBridge Health AI will notify affected individuals within 60 days per 45 CFR §164.404, as well as the U.S. Department of Health and Human Services. Contact privacy@kinbridgehealth.com with any questions.