Designed for HIPAA. Here is exactly where we stand.

This page lists every safeguard we claim, and says plainly which ones are built today and which are in place before launch. Nothing here is a certification, because no such certification exists.

Last reviewed October 21, 2026

Where we are today

LumiDesk has not launched yet. No clinic's patient data is in LumiDesk today. At launch, every clinic signs a Business Associate Agreement with us before any patient data enters the product.

Is LumiDesk HIPAA compliant?

The U.S. Department of Health and Human Services does not certify software, or anyone else, as HIPAA compliant. A badge or seal that says otherwise was issued by a private company, not by the government.

What HIPAA requires of a software vendor that handles patient data (a business associate) is a signed Business Associate Agreement with each clinic, administrative, physical and technical safeguards for that data, a written risk analysis, written security policies, and breach notification. Compliance is something a vendor does continuously, not something it is awarded.

Whatever software you choose, it is worth asking the vendor:

• Will you sign a BAA, on which plans, and for what fee?
• Where is our data hosted, and does that host sign a BAA with you?
• Which of your safeguards exist today, and which are planned?
• Who at your company is responsible for security, by name?
• Which other companies handle our data, and what do they receive?

Built into LumiDesk

• Each clinic's data kept apart from every other clinic's.
• Role-based permissions, with revealing an SSN as its own permission.
• Invite-only staff accounts.
• Rate-limited sign-in that never reveals whether an account exists.
• Self-serve export of all your clinic's data, including for 30 days after you cancel.

Before launch

Each of these is a firm commitment for launch. It moves into the list above only once we have checked that it is true.

• No diagnoses, procedure codes or clinical notes sent to our messaging or payment providers.
• Every build scanned for leaked secrets and vulnerable dependencies.
• Required authenticator-app MFA on every staff account.
• Automatic logoff after inactivity on every staff account.
• Access ends immediately when a staff member is deactivated.
• An audit log of who viewed or changed a patient record.
• Deletion of all your clinic's data within 30 days of your request, or the end of your paid period, whichever is later.
• Hosting on HIPAA-eligible AWS services under a signed AWS BAA.
• Encryption in transit, including to the database.
• Encryption at rest.
• Automated backups.
• Our BAA text, published.
• Our subprocessor list, published.
• Visit transcripts deleted when the note is signed, or 14 days after the visit if it never is.
• Your patients' data never used to train an AI model, ours or anyone else's.
• Visit recordings transcribed on our own servers and deleted as soon as they are, never stored and never sent to a transcription company.
• Your patients' data processed only in AWS US Regions.
• Note drafting run on AWS under our BAA, with your patients' data never reaching the company that makes the model.

What deletion does not reach

Before we delete at your request, your clinic confirms that it has kept whatever records the law requires it to keep, because we keep no copy of them for you. Deletion then removes every row of your clinic's data except its deletion record: our proof that the deletion happened, which we keep for six years and which holds no patient data. A few copies outlive the deletion for a time:

• Backups, for up to 35 days. They stay protected under the BAA, are used only to recover from a failure, and are then destroyed. If we ever restore one, the deletion runs again.
• Database space that held your data and has not yet been reused.
• Logs: our email provider's delivery logs for up to 30 days and its stored copies of messages for up to 7, our infrastructure logs for their set retention period, including access logs that carry your clinic's identifier and some staff email addresses, and AWS's audit trail of account activity for 90 days.
• Do-not-contact lists: email addresses that bounced, unsubscribed or marked our mail as spam, and phone numbers that opted out of text messages.
• Your clinic's own Stripe account, which is disconnected from LumiDesk, not closed. Your clinic keeps its balance, payouts, payment history and card readers there. Our billing records for your subscription stay with Stripe.

The worst case, from your request: deletion within 30 days, or at the end of your paid period if that is later, then up to 35 more days until the last backup is gone.

Patient accounts and online booking

Patients sign in to their clinic's portal with an account of their own, kept apart from staff accounts. The public booking page is the one part of LumiDesk anyone can use without an account. Both are held to these rules:

• Required authenticator-app MFA on every patient account. Before launch.
• Automatic logoff after inactivity on every patient account. Before launch.
• Access ends immediately when a clinic revokes a patient's portal access. Before launch.
• No health information collected on the public booking page. Before launch.
• Online booking that never reveals whether someone is already a patient. Before launch.

Your Business Associate Agreement

Every clinic signs a BAA with us, on every subscription, at no fee. It is bound at signup, before any patient data enters LumiDesk. The full text is published at launch, after review by our attorney.

What your clinic is responsible for

HIPAA puts duties on both sides of the BAA. We secure LumiDesk; these stay with your clinic:

• Deactivating a staff member's account promptly when they leave, and giving each role only the permissions it needs.
• One login per person. Front-desk, billing and admin staff are free, so there is never a reason to share one.
• Securing the computers and phones your staff use to sign in.
• Handling exports and printouts of patient data safely.
• Getting consent from each patient, or someone able to consent for them, and from anyone else the law where you practice requires, before a visit is recorded, and noting the patient's in LumiDesk.
• Your own HIPAA program: a privacy officer, a risk analysis, staff training, a Notice of Privacy Practices, and breach reporting.
• Signing the BAA.

Who is accountable

Drew, LumiDesk's founder, is its designated HIPAA security official.

Reporting a security issue

Email security@lumidesk.io. The inbox is monitored, and our contact details are also published at /.well-known/security.txt.

• Tell us what you found and how to reproduce it.
• Do not access, change or keep any patient data, and do not disrupt the service.
• Give us a reasonable time to fix the issue before you share it.
• We do not run a paid bug bounty.

How we handle information from visitors to this website and people on our waitlist is in our Privacy Policy.