Trust Center

Built for healthcare, from day one.

QR Rx is engineered to meet HIPAA from the first patient record onward. Encryption, BAA-covered infrastructure, role-based access, audit logging, and a full subprocessor disclosure live here so a procurement team can finish their review in one read.

Encryption

All data is encrypted in transit using TLS 1.2+
All data is encrypted at rest on our database and storage servers
Patient access PINs are encrypted at rest, with a separate keyed lookup hash used for verification
JWT tokens are signed with a secure secret and expire after 24 hours

Infrastructure

Hosted on Render's HIPAA-compliant infrastructure with a signed BAA
File storage on AWS S3 with a signed BAA
Database hosted on Render Postgres with automatic backups
All services run in isolated, hardened environments

HIPAA Compliance

Business Associate Agreements (BAAs) are required for every vendor authorized to process PHI
No Protected Health Information (PHI) is transmitted to third-party AI services
Email and SMS are delivered through contracted HIPAA-oriented providers, with message content minimized
AI-powered features use procedure-level content only, never patient identifiers

Access Controls

Role-based access control: Owner, Practitioner, Admin, and Staff roles
Human patient verification requires a QR token, 6-digit PIN, and date of birth; veterinary plans use owner last name instead of date of birth
Login rate-limited to 5 attempts per 15 minutes
Patient verification rate-limited to 5 attempts per hour
Team members can only access data within their assigned practice

Audit & Monitoring

Security-relevant and PHI-access events are recorded in database audit trails
Patient engagement events are tracked for provider visibility
Email delivery is logged with suppression list management
Legal acceptances are recorded with timestamp, IP address, and user agent

Patient Privacy

Patients access care plans via a secure, time-limited browser session. No account required.
Patient sessions automatically expire after the recovery period ends
SMS delivery of care plans requires explicit patient opt-in consent
Patient data is never sold and is disclosed only to the treating provider, authorized users, and contracted services described in our Privacy Policy

Data Retention

Patient access audit log (patient_view) preserved indefinitely per HIPAA Security Rule
API access audit log (http_request) retained 90 days, then pruned by daily cron
EHR launch session payloads expire 30 minutes after issuance
Provider data snapshots retained 90 days per provider, capped at 50 most recent
Account closure: clinic data retained 6 years per HIPAA, then permanently deleted on request

Incident Response

Designated Security Official: dnelson@qrrx.io. Active during business hours, on-call for confirmed incidents.
Breach notification: affected covered entities notified within 60 days of confirmed PHI breach (HIPAA Breach Notification Rule)
Incident triage runbook: identify scope, contain, document, notify affected parties, root-cause analysis
Patient-side error capture via /api/client-errors with PHI scrubbing before storage
Active-incident contact: trust@qrrx.io flagged URGENT in subject line

Continuous Monitoring

Server-side error logging with PHI-scrubbing fingerprint dedup
Per-IP rate limiting on every public endpoint (login, patient verification, lead form, subscribe, dispute, review)
Cloudflare Turnstile bot protection on every public POST surface
Stripe webhook signature verification + idempotent event handling
Automated subscription state reconciliation across Stripe and the directory verified-aftercare badge
Annual third-party penetration test scheduled for Q4 2026 (results available via trust@qrrx.io under NDA)

Subprocessors

Every external service that touches QR Rx data, in one table.

A subprocessor is a third party we use to run the platform. We disclose every one, its function, the data classification, and BAA status. PHI = Protected Health Information; "BAA signed" means we have a Business Associate Agreement on file with that vendor; "BAA not required" means the vendor does not process PHI by architectural design (procedure-level content only, or billing-only data).

LAST UPDATED · JULY 18, 2026 · subscribe to changes

Infrastructure

Render
Application hosting + Postgres database
US
PHIBAA Signed
AWS S3
Logo + asset storage, provider data snapshots
US
PHIBAA Signed

Communications

Paubox
Transactional email delivery (HIPAA-covered)
US
PHIBAA Signed
Telnyx
SMS delivery (care plan links + reminders)
US
PHIBAA Signed

AI / Translation

Anthropic (Claude)
Patient Q&A + template parsing (data minimized; direct identifiers redacted before patient fallback)
US
No PHI authorizationBAA N/A
Google Translate
Care plan translation (procedure content only, no PHI)
US / global
No PHI authorizationBAA N/A

Billing

Stripe
Subscription billing + payment processing
US / global
No PHI authorizationBAA N/A

Reliability / Measurement

Google Ads
Public/provider acquisition conversion measurement; disabled on patient routes
Global
No PHI authorizationBAA N/A
Sentry
PHI-scrubbed error monitoring; replay, tracing, logs, bodies, cookies, and default PII disabled
US
No PHI authorizationBAA N/A

Need our DPA, security questionnaire (CAIQ / SIG), or vendor-risk packet? Email trust@qrrx.io and we'll send the latest. We respond within one business day.

Compliance

Questions about our security posture?

If you'd like to review our BAA, request a security questionnaire, or discuss compliance, we're happy to help.