HIPAA Security Policy

Effective June 10, 2026

This HIPAA Security Policy documents the administrative, technical, and physical safeguards Relvema has implemented to protect electronic protected health information (ePHI) in accordance with the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C). Relvema operates as a Business Associate and these policies apply to all systems that create, receive, maintain, or transmit ePHI.

1. Technical safeguards

1.1 Encryption

• At rest: All ePHI stored in Google Cloud Firestore and Google Cloud Storage is encrypted using AES-256 with keys managed by Google Cloud Key Management Service (KMS) under Relvema’s GCP project. This covers structured data (transcripts, notes, patient records, mood scores, homework) and unstructured data (session audio files).
• In transit: All network traffic between clients (browser, mobile app) and Relvema servers is encrypted using TLS 1.2 or higher. Firebase App Hosting enforces HTTPS; HTTP requests are redirected. Internal service-to-service calls within GCP are encrypted over Google’s private network.

1.2 Access control

• Firebase Authentication: All users authenticate through Firebase Authentication using email/password with optional passkey (FIDO2/WebAuthn) second factor. Phone number verification is required during account creation.
• Firestore row-level security: Firestore security rules enforce strict per-therapist data isolation. A therapist can only read session data, transcripts, and notes for patients who have explicitly accepted a connection invitation to their account. Cross-therapist data reads are blocked at the database rule layer, not just the application layer.
• Patient data access: Patients accessing the mobile app can read only their own data (journal entries, homework, mood logs, scheduled sessions). They cannot access therapist-generated clinical notes or other patients’ data.
• Session audio access: Audio files in Cloud Storage are not publicly accessible. Access requires a signed URL generated server-side by the Firebase Admin SDK using a service account credential stored in Google Secret Manager. Signed URLs expire after 15 minutes.
• Admin access: Relvema administrative operations use the Firebase Admin SDK with service account credentials that are scoped to the minimum necessary permissions and rotated on a scheduled basis.

1.3 Audit controls

• Google Cloud Data Access audit logs (DATA_READ and DATA_WRITE) are enabled on all Relvema GCP projects. Every read and write to Firestore collections containing ePHI is logged, including the authenticated identity performing the operation, the resource accessed, and the timestamp.
• Audit logs are retained in Google Cloud Logging for a minimum of 400 days and can be exported to Cloud Storage for longer-term retention.
• Application-level activity (session recordings initiated, notes generated, patients connected) is logged to a separate analytics collection for operational monitoring.

1.4 Automatic logoff and session management

• Firebase ID tokens expire after one hour and are refreshed automatically. Refresh tokens can be revoked by Relvema administrators in response to a security incident.
• Session audio upload URLs and meeting authentication tokens carry short expiration times (15 minutes and 2–48 hours respectively) to limit exposure if a link is intercepted.

1.5 AI processing boundary

• All AI inference — transcription, SOAP/DAP/BIRP note generation, session summaries, and clinical insights — is performed exclusively on Google Vertex AI within Relvema’s GCP project. ePHI never leaves the Google Cloud network boundary.
• Relvema does not use any third-party AI APIs (OpenAI, Anthropic, AWS Bedrock, or similar). This eliminates the risk of ePHI exposure to external AI providers not covered by Relvema’s Google Cloud BAA.
• Google Vertex AI does not use customer data to train its foundation models. Data processed through the Vertex AI API is not retained by Google for training purposes.

2. Administrative safeguards

2.1 Security Officer

Relvema has designated a Security Officer responsible for developing, implementing, maintaining, and enforcing security policies and procedures. The Security Officer is the primary point of contact for HIPAA security incidents and compliance inquiries. Contact: compliance@relvema.com.

2.2 Workforce access management

• Access to production systems and ePHI is granted on a least-privilege, need-to-know basis. All access is governed by Google Cloud IAM roles scoped to specific GCP services and resources.
• Org-level GCP policy blocks the creation of service account keys (long-lived credentials), requiring all access to use short-lived credentials or Workload Identity Federation.
• Access privileges are reviewed quarterly and revoked promptly when an individual no longer requires access.

2.3 Security awareness

All Relvema personnel with access to systems processing ePHI are trained on HIPAA requirements, security best practices, and incident reporting procedures before being granted access to production systems.

2.4 Business associate management

Relvema maintains a signed BAA with Google LLC (Google Cloud Platform) covering all GCP services used to process ePHI. No ePHI is shared with any vendor, subprocessor, or sub-business associate that has not executed an appropriate BAA or equivalent data protection agreement with Relvema.

2.5 Risk analysis

Relvema conducts security risk assessments on a periodic basis and whenever significant infrastructure changes are made. Risk analysis findings are documented, prioritized, and tracked to remediation.

3. Physical safeguards

3.1 Facility access controls

Relvema operates entirely on cloud infrastructure and maintains no physical servers or data centers. All ePHI is stored in Google Cloud data centers. Google’s physical security program includes:

• Multi-layer physical access controls (biometric authentication, badge access, 24/7 on-site security).
• Video surveillance of data center perimeters and access points.
• Secure hardware disposal procedures to prevent data remanence.
• Certifications: SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, and FedRAMP High.

3.2 Workstation security

• All Relvema engineering workstations require full-disk encryption and screen lock on inactivity.
• Multi-factor authentication is required for all Relvema Google Workspace and GCP Console access.
• No ePHI is downloaded to local workstations during normal operations; all access is through authenticated API calls.

4. Incident response

Relvema follows a documented incident response procedure for potential security incidents involving ePHI:

1. Detection and reporting: Potential incidents are detected through GCP audit log alerts, anomaly detection, and direct reports to security@relvema.com.
2. Assessment: The Security Officer assesses the incident to determine whether a Breach of Unsecured PHI has occurred within 24–72 hours of detection.
3. Containment: Affected access paths are revoked, vulnerable systems are isolated, and temporary mitigations are deployed as quickly as possible.
4. Notification: If a Breach is confirmed, affected Covered Entities are notified without unreasonable delay and within 60 days of discovery, as required by 45 C.F.R. § 164.410.
5. Remediation: Root cause is identified, permanent fixes are implemented, and post-incident review is documented.

To report a potential security incident, email security@relvema.com immediately. Do not include ePHI in initial incident reports sent by email.

5. Policy review

This policy is reviewed at least annually and whenever significant changes to Relvema’s infrastructure, services, or regulatory requirements occur. The current version of this policy is always available at relvema.com/legal/hipaa-security.

For questions about Relvema’s security program, contact compliance@relvema.com.