HIPAA Compliance

1. Overview

ClearAlignerAI is built from the ground up with healthcare data security in mind. As a platform that handles Protected Health Information (PHI) on behalf of dental practices, we operate as a Business Associate under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations, including the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule.

This page describes the technical, administrative, and physical safeguards we maintain to protect PHI and support your practice's compliance obligations.

2. Business Associate Agreement

Under HIPAA, any entity that creates, receives, maintains, or transmits PHI on behalf of a Covered Entity (such as a dental practice) must execute a Business Associate Agreement (BAA). ClearAlignerAI is prepared to enter into a BAA with any subscriber that qualifies as a Covered Entity.

Our BAA covers:

• Permitted uses and disclosures of PHI;
• Obligations to implement appropriate HIPAA safeguards;
• Breach notification obligations and timelines;
• Rights of the Covered Entity to access, amend, and receive an accounting of disclosures of PHI;
• Obligations of sub-processors (subcontractors) that handle PHI on our behalf;
• Data return or destruction upon termination of the agreement.

3. PHI Handling Procedures

We follow a strict minimum-necessary principle when handling PHI. Access to patient data is restricted to systems and personnel that require it to deliver the Service.

3.1 Data Minimisation

We collect only the PHI necessary to complete AI-assisted treatment plan generation. We recommend that practices use de-identified or pseudonymised patient identifiers. We do not require the collection of patient names, dates of birth, or government identifiers.

3.2 AI Processing

PHI submitted for AI analysis is transmitted to Anthropic's Claude API under an executed Data Processing Agreement. Anthropic processes data on a transient basis — it is not stored beyond the immediate inference call, and Anthropic does not use submitted PHI to train its models.

3.3 Permitted Disclosures

We will only disclose PHI:

• As directed by the Covered Entity in writing;
• As required to provide, maintain, or improve the Service;
• As required by law, including in response to valid legal process;
• As necessary in a public health emergency, as permitted under HIPAA.

We will not disclose PHI for marketing, fundraising, or any commercial purpose not related to the Service.

3.4 De-identification

Upon request, we can assist practices in establishing de-identification workflows prior to data submission. De-identified data that meets the HIPAA Safe Harbor or Expert Determination standard is not subject to the HIPAA Rules and may be handled under less restrictive conditions.

4. Access Controls

We implement comprehensive access controls to ensure that PHI is accessible only to authorised personnel and systems:

• Unique user identification Every user is assigned a unique account identifier. Shared credentials are not permitted.
• Multi-factor authentication (MFA) MFA is available for all accounts and strongly recommended for practices handling significant volumes of PHI.
• Role-based access control (RBAC) Within a practice account, access can be restricted by role — ensuring team members can only access the records relevant to their work.
• Automatic session timeout Sessions are automatically terminated after a configurable period of inactivity (default: 30 minutes).
• Least privilege Internal ClearAlignerAI staff access to production systems is restricted on a need-to-know basis, subject to regular review.
• Emergency access procedures Documented emergency access procedures are maintained for situations requiring system-level intervention to protect patient data.

5. Audit Logging

ClearAlignerAI maintains comprehensive audit logs of all activities involving PHI. Audit logs are tamper-evident, stored separately from operational systems, and retained for a minimum of 24 months.

Logged events include:

• User login and logout events (including IP address and device)
• PHI upload, access, modification, export, and deletion events
• AI analysis requests and completions
• Changes to user permissions and account settings
• Administrative actions performed by ClearAlignerAI staff
• System error events that could indicate security incidents

Practices may request an audit log export for their account at any time by contacting felipe@novodental.net. Log exports are provided in structured format (JSON or CSV) within 5 business days of request.

6. Breach Notification Procedures

In the event of a suspected or confirmed breach of unsecured PHI, ClearAlignerAI follows a structured incident response process aligned with HIPAA's Breach Notification Rule (45 CFR §§ 164.400–414).

6.1 Incident Detection and Response

Our security monitoring systems are designed to detect anomalous access patterns, data exfiltration indicators, and other security events in real time. Upon detection of a potential incident:

1. The incident is immediately escalated to our Security Officer;
2. Affected systems are isolated to contain the potential breach;
3. A risk assessment is conducted to determine whether a breach of unsecured PHI has occurred;
4. Evidence is preserved for forensic analysis.

6.2 Notification Timeline

If a breach of unsecured PHI is confirmed:

• Within 60 days of discovery, we will notify all affected Covered Entities;
• Our notification will include the nature of the breach, the PHI involved, likely causes, and actions taken;
• We will provide guidance on steps the Covered Entity should take to mitigate potential harm;
• Where required, we will assist the Covered Entity in meeting their own notification obligations to affected individuals and the Secretary of HHS.

6.3 Reporting a Security Concern

If you suspect unauthorised access to your account or patient data, contact us immediately at felipe@novodental.net with "SECURITY INCIDENT" in the subject line. We will respond within 4 hours during business hours (AEST).

7. Employee Training

All ClearAlignerAI team members who may come into contact with PHI or systems containing PHI receive HIPAA-focused security and privacy training:

• Onboarding training: New team members complete HIPAA awareness training before receiving access to production systems.
• Annual refresher training: All relevant personnel complete annual HIPAA refresher training covering the Privacy Rule, Security Rule, and current threat landscape.
• Incident response training: Personnel involved in security monitoring and incident response receive specific training on breach identification, escalation, and documentation.
• Acceptable use policy: All team members sign an acceptable use policy covering appropriate handling of PHI and confidential information.

Training completion is tracked and records are maintained by our Privacy Officer.

8. Encryption Standards

ClearAlignerAI applies encryption standards that meet or exceed HIPAA's addressable implementation specification for encryption and decryption (45 CFR § 164.312(a)(2)(iv) and § 164.312(e)(2)(ii)):

• Data in transit: TLS 1.3 All data transmitted between clients and our servers, and between our servers and sub-processors, uses TLS 1.3. TLS 1.0 and 1.1 are disabled. HSTS is enforced.
• Data at rest: AES-256 All stored data — including scans, treatment plans, and patient records — is encrypted at rest using AES-256, the NIST-recommended standard.
• Key management: HSM-backed Encryption keys are managed using hardware security modules (HSMs). Keys are rotated on a scheduled basis and access to keys follows the principle of least privilege.
• Database encryption Databases use transparent data encryption (TDE) with additional field-level encryption applied to PHI fields.
• Backup encryption All database backups are encrypted using AES-256 and stored in geographically separate locations.
• Password hashing User passwords are never stored in plaintext. We use bcrypt with a cost factor of 12 or higher.

9. Compliance Certifications

ClearAlignerAI is committed to pursuing formal compliance certifications as the platform matures. Our current compliance status:

• HIPAA Privacy & Security Rules compliance Active We operate under HIPAA-aligned policies and are prepared to execute BAAs with Covered Entities.
• Australian Privacy Act 1988 (APPs) compliance Active We comply with the Australian Privacy Principles governing our operations.
• SOC 2 Type II In Progress We are engaged with a third-party auditor to complete SOC 2 Type II certification. Expected completion: Q4 2026.
• ISO 27001 In Progress ISO 27001 certification for our information security management system is planned for 2027.
• Penetration testing Annual Independent penetration testing is conducted annually. Summary findings are available to enterprise subscribers upon request.

We will update this page as new certifications are achieved. Subscribers requiring current certification documentation should contact felipe@novodental.net.

10. Contact Our Privacy & Security Team

For HIPAA inquiries, BAA requests, security concerns, audit log requests, or any compliance-related matter:

This HIPAA Compliance page is reviewed and updated at least annually and whenever material changes are made to our data handling practices. For the most current version of our compliance documentation, please check this page or contact us directly.