How Your Health Information Is Protected

In Summary

Your screening answers and your consultation are protected health information. They are encrypted, access is limited to the clinician assessing you and the small support team who need it to run your case, and your letter discloses no diagnosis to your landlord. We do not sell your data, and we do not send your health information to advertising platforms.

Safeguards in Place

Technical

• TLS 1.2 or higher in transit; AES-256 at rest for stored records.
• Role-based access control, with clinicians able to see only files assigned to them.
• Multi-factor authentication required for every clinician and staff account.
• Audit logging of every access to a record, retained and reviewed.
• Automatic session expiry, and no clinical data held on personal devices.

Administrative

• Business associate agreements with every vendor that touches protected health information.
• Annual HIPAA training for all staff and network clinicians.
• A named privacy officer, reachable at support@thehealifypet.com.
• Documented breach notification procedure, with notification within statutory timeframes.
• Minimum necessary standard applied to every internal disclosure.

Physical

• Records held with SOC 2 Type II audited hosting providers in US data centers.
• No paper files. Anything received on paper is scanned and shredded.

What Your Landlord Receives

A letter stating that you meet the Fair Housing Act definition of a person with a disability, that an animal alleviates identified symptoms, and that an accommodation is recommended. Your diagnosis, your screening answers, your consultation notes and your treatment history stay with your clinician. If a housing provider asks us for more, the answer is no, and we will tell you they asked.

Your Rights

• Access. Request a copy of your record; we respond within 30 days.
• Amendment. Ask for a correction to inaccurate information.
• Accounting of disclosures. Ask who your information has been shared with.
• Restriction. Ask us to limit certain uses or disclosures.
• Deletion. Request deletion, subject to the record retention periods clinicians are legally required to observe in their state.
• Complaint. To our privacy officer, and to the HHS Office for Civil Rights. We will not retaliate for a complaint, ever.

Retention

Clinical records are retained for the period the treating clinician's state licensing board requires, which is commonly between five and ten years. Incomplete screenings are deleted after 12 months. Payment records are held as long as tax law requires and contain no clinical information.

What We Do Not Do

• Sell, rent or trade your information.
• Send health information to advertising or analytics platforms.
• Use your clinical answers for marketing.
• Publish a review or testimonial without your explicit written consent.