Why this page exists.
Leo handles Protected Health Information (PHI) as defined by HIPAA. This page documents the technical and administrative safeguards we have in place today, the patient rights we honor, and the status of our Business Associate Agreement (BAA) with Google Cloud — which is in progress and is the gating item before we can claim formal HIPAA compliance.
We have written this page in plain English wherever possible, with the right legal terms where required. Citations to the regulation itself (§164.308, §164.310, §164.312, §164.404) are inline. If something here is unclear, the contact in §10 is for you.
Our current standing.
Leo is HIPAA-ready, not HIPAA-compliant. The HIPAA Security Rule's technical safeguards (§164.312) are implemented in the iOS app and the Cloud Functions that serve it. The BAA with Google Cloud is in progress. We do not claim HIPAA compliance until two things are true: (1) the BAA has been executed, and (2) a third-party assessment has been completed.
Until then, “ready” is the word we use. Other phrasings — “HIPAA-compliant,” “HIPAA-certified,” “fully HIPAA” — are not accurate today and you should not encounter them anywhere on this site.
Technical safeguards (§164.312).
Each subsection below maps to a specific requirement of the HIPAA Security Rule's technical safeguards. We name the algorithm or mechanism that implements it.
For the file-and-line citations behind each of these claims, see /security.
Administrative safeguards (§164.308).
Leo is a small organization in private beta. Our administrative posture reflects that, and we name it honestly.
Physical safeguards (§164.310).
Physical safeguards cover the facilities where PHI lives. For Leo, that is two places:
Field-level PHI encryption.
Leo encrypts PHI fields individually before they are written to Firestore — not just “at rest by the cloud provider.” The fields below are encrypted on your device with your DEK and decrypted on read. Queryable metadata (dates, IDs, types) stays plaintext so the app can function; the body of every entry is ciphertext on the wire.
medicationsdoseLogsprnMedicationsprnDoseLogsvitalSignshealthEventsjournalEntriessleepJournalemotionLogsmentalHealthSymptomsleoConversationsclinicalNotestreatmentPlansassessmentResponseslabReportslabValuessymptomLogsflareUpshealthLogssleepDatasleepRecordsEncrypted-on-write, decrypted-on-read transparently. View models never see plaintext on the wire, and the admin console never sees plaintext at all. Twenty-three or more collection types carry per-field encryption today.
Your patient rights under HIPAA.
HIPAA grants individuals specific rights with respect to their PHI. Leo honors each of them today, in the following ways:
Request a copy of any PHI we hold on you. Native export to PDF, JSON, or CSV is built into Leo.
Request corrections to inaccurate PHI we hold. Most fields are user-editable directly in the app; amendments to read-only records can be requested by writing to legal@leomindbody.com.
Request a list of who else has accessed your PHI. Leo's append-only audit log surfaces this automatically — every link's access is recorded with timestamp and actor.
Restrict who Leo shares your data with. The in-app sharing toggles (per role, per data type) implement this. Any link can be revoked at any time.
Request deletion of your account and PHI. We process and confirm deletion within thirty (30) days.
We notify you within sixty (60) days of discovering any breach affecting your PHI, per HIPAA §164.404. See §09 below for the full breach-notification posture.
Business Associate Agreements.
HIPAA requires Business Associate Agreements (BAAs) with any vendor that touches PHI on a covered entity's behalf. Status of Leo's BAAs today:
Breach notification.
In the event of a breach affecting unsecured PHI, Leo follows HIPAA's Breach Notification Rule (§164.400 et seq.):
How to contact us.
For any HIPAA-related question, complaint, or to exercise a patient right (see §07):
You also have the right to file a complaint directly with the U.S. Department of Health & Human Services, Office for Civil Rights (OCR), without notifying us first. OCR's complaint portal is at hhs.gov/hipaa/filing-a-complaint. Leo will not retaliate against any individual for filing a complaint.
Roadmap items we name out loud.
Most legal notices show only what an organization has done. This is the section where we name what we have not done yet — so the rest of the page can be read with confidence that we are not hiding gaps.
Today the audit log is append-only and made immutable by Firestore rules. A SHA-256 hash-chain across audit records (each record carrying the hash of the prior record so any tamper attempt breaks the chain) is on our near-term build list. When it ships, this notice will be updated and the corresponding claim in §03 will move from "append-only, immutable by rule" to the stronger "tamper-evident chain."
There is currently no automatic deletion of audit records or other PHI after a fixed retention window. HIPAA itself requires a minimum of six years for documentation; a retention service that enforces deletion at the upper bound (and exposes the policy to users) is on the roadmap.
We have not yet engaged an independent assessor for a formal HIPAA compliance review. This will happen after the Google Cloud BAA is executed and is the second of the two gating items before we claim formal HIPAA compliance.
On the near-term roadmap. Documentation, controls, and the audit trail a Type I audit requires are being assembled before we engage a CPA firm. Type II requires a subsequent observation window.