Data Privacy
What are my rights regarding data privacy?
As a provider using HiBoop, you and your clients have the following rights regarding clinical data:
- Right to Access: You can access and export client data at any time, from the Outcome Report or a client's page.
- Right to Portability: Results export as CSV or PDF, or copy straight into your EMR.
- Right to Erasure: You can request the permanent deletion of account data, subject to local clinical record retention laws.
Does HiBoop share client data with third parties?
No. HiBoop does not sell, lease, or share patient-identifiable data with third parties for marketing or any other non-clinical purpose. Data is only processed to provide the core services of the platform (e.g., scoring assessments and generating reports).
How do I review HiBoop's Terms of Service and Privacy Policy?
Our full legal documentation is always available:
Security Standards
Is HiBoop HIPAA and PIPEDA compliant?
Yes. HiBoop is built to meet healthcare privacy laws in the US (HIPAA) and Canada (PIPEDA and PHIPA), and is SOC 2 Type II certified. All data is encrypted in transit and at rest.
For a detailed breakdown of certifications and security architecture, see the Trust Center.
Where is data stored?
HiBoop is hosted on Google Cloud in the US or Canada, with other regions on request.
Is a Business Associate Agreement (BAA) available?
Yes. A BAA is available for US-based covered entities and their business associates. See the BAA Policy for details, or contact our team to request one.
Clinical Evidence
Where do the assessments come from? Are they validated?
All assessments in HiBoop are sourced from published clinical research. We do not modify scale wording, scoring, or thresholds. A full list of citations and references is available in the Clinical Sources directory.
Does HiBoop interpret assessment results for me?
No. HiBoop scores assessments and surfaces severity labels based on published cutoffs, but clinical interpretation and diagnosis are always the clinician's responsibility. More on how scoring works →
How does HiBoop protect patient data?
HiBoop is designed with a privacy-first architecture to safeguard sensitive health information. We follow stringent protocols to ensure all data is secure, accessible only by authorized users, and compliant with relevant privacy regulations.
All assessment responses are stored securely and only accessible to authorized users within your clinic. Your clients’ data belongs to them, and to you as their care provider. HiBoop simply helps you handle it responsibly.
Compliance standards
HiBoop complies with:
- HIPAA (United States)
- PIPEDA / PHIPA (Canada)
- SOC 2 Type II certified
For a full breakdown of compliance, certifications, and Business Associate Agreement (BAA) details, visit the Trust Center.
Key security features
| Feature | What it does |
|---|---|
| Encryption | All data encrypted in transit and at rest |
| Two-factor authentication | Staff can turn it on, and admins can require it for a role |
| Role-Based Access Controls | Staff only see and manage what their role permits, learn about roles |
| Audit Logs | All activity is logged and time-stamped for transparency |
| Hosting | Google Cloud in the US or Canada, with other regions on request |
| BAA Available | Business Associate Agreements available on request |
Your rights as a provider
- Right to access: Export client data at any time, from the Outcome Report or a client's page
- Right to portability: Results export as CSV or PDF, or copy into your EMR
- Right to erasure: Request permanent deletion of account data, subject to local clinical record retention laws
Further reading
Ready to try it with a real client?