Built with clinical data in mind

Alcove handles protected health information — the technical controls below are how we approach that responsibility.

Technical controls are one part of compliance

Strong technical controls don't by themselves make a platform "HIPAA compliant" — that also requires organizational, contractual, administrative, and legal controls on both sides. See our Business Associate Agreement for how responsibilities are shared.

Tenant isolation

Every organization's data is scoped at the database layer — one practice can never read another's records, enforced by row-level security, not just application code.

Role-based access

Fine-grained permissions per role — a receptionist and a clinician see different things by design, down to individual resource types.

Audit logging

Every access to sensitive records is logged, with a compliance dashboard tracking policies, retention, and vendor assessments.

Encryption

Data is encrypted in transit and at rest; secrets such as connected integration credentials are encrypted before they ever touch the database.

Configurable retention

Retention periods for notes, recordings, transcripts, and messages are configurable per resource type, with support for legal holds.

Clinician control over AI

AI drafts a note; it never commits one. Every AI-generated note requires explicit clinician review before it becomes part of the record.