🔒 Security, HIPAA, & Privacy FAQ

What is a BAA, and why does it matter?

A Business Associate Agreement (BAA) is a legal contract required by HIPAA. It is signed between a healthcare provider (like a BCBA or clinic) and a software vendor. In a standard BAA, the vendor promises to safely handle, store, and protect any readable patient data that enters their cloud system. If the vendor leaks that data, they share legal liability for the breach. [1, 2, 3]

Why doesn't this app require a BAA?

A BAA is only legally required if a software vendor has the technical ability to view, read, or possess Protected Health Information (PHI). Because this app uses Zero-Knowledge Client-Side Encryption, your data is turned into unreadable code before it leaves your device. [1, 2]

We do not hold the keys to decode it. Because we physically cannot read or access the learner's identity, we never legally "possess" PHI. Therefore, a BAA is structurally unnecessary. [1]

Is this app technically HIPAA-compliant?

Yes. The app satisfies the technical safeguards of the HIPAA Security Rule. Instead of relying on a legal contract (a BAA) to protect a vulnerable cloud database, the app relies on mathematics. By encrypting the data locally, your cloud backups are fully secure and out of scope for HIPAA data-handling audits.

How is my data encrypted?

The app uses industry-standard AES-256-GCM encryption. When you create a learner profile, a unique cryptographic key is generated directly on your phone or tablet. This key lives exclusively in your device's hardware secure enclave (like iOS Keychain or Android Keystore). The cloud server only hosts unreadable ciphertext blocks (e.g., g7X$9!qZ...).

Do I still need to secure my physical device?

Yes. Because the decryption keys live strictly on your device, your physical phone or tablet is the primary compliance safeguard. To maintain HIPAA compliance, you must follow your organization’s mobile device management policies. This includes enabling biometric locks (FaceID/Fingerprint), requiring a strong passcode, and hiding notification previews on your lock screen.

Can the app developers recover my data if I lose my device?

No. Because we adopt a strict zero-knowledge architecture, we do not have a master key or a copy of your device's local key. If you lose your device and do not have an encrypted device backup, we cannot decrypt or recover your data for you.

Is it safe for parents to use this app?

Absolutely. HIPAA regulations apply only to Covered Entities (like BCBAs and healthcare clinics), not to parents tracking their own children. However, because the app enforces AES-256 client-side encryption universally, parents benefit from the exact same institutional-grade privacy safeguards as medical professionals. [1, 2]