HIPAA Compliance

MyLÚA Health is built with HIPAA compliance as a foundational requirement, not an afterthought. This page explains how we protect your health information, how our platform is architected to keep your data safe, and what your rights are as a user.

Our commitment: Protected Health Information (PHI) is never sent to AI language models. It is tokenized, role-gated, and encrypted at the data layer: by design, not by policy alone.

End-to-End Encryption

All data in transit and at rest is encrypted using industry-standard protocols. Personally identifiable and protected health information is never exposed in plaintext outside of authorized application layers.

PHI Never Touches AI Models

Our platform architecture enforces a hard boundary: PHI is tokenized and stored in role-gated, encrypted data stores with strict consent controls. AI reasoning and language generation operate on de-identified or anonymized representations only. Even if downstream systems were compromised, sensitive data would remain protected.

Role-Based Access Controls

Access to individual health records is governed by strict role-based consent. Care teams only see data that their clients have explicitly authorized them to view. No member of our staff (or any third-party system) can access PHI beyond what is required for the authorized purpose.

Audit Trails and Governance

Every access event involving PHI is logged and auditable. Our platform is built on enterprise-grade, managed cloud infrastructure designed to support regulatory compliance, auditability, and data isolation at scale, across a hybrid cloud architecture.

Business Associate Agreements

MyLÚA Health enters into Business Associate Agreements (BAAs) with covered entities and other business associates as required under HIPAA. If your organization requires a BAA, please contact us at letsconnect@myluahealth.com.

Breach Notification

In the event of a security incident involving PHI, MyLÚA Health will notify affected individuals and relevant authorities within the timeframes required by the HIPAA Breach Notification Rule. Our professional and organizational users are also obligated under our Terms of Service to immediately notify us and affected individuals of any unauthorized use or disclosure of PHI they access through the platform.

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that establishes national standards to protect sensitive patient health information. HIPAA applies to covered entities (such as health plans, healthcare clearinghouses, and healthcare providers) as well as business associates that handle PHI on their behalf.

HIPAA requires that appropriate administrative, physical, and technical safeguards be in place to ensure the confidentiality, integrity, and availability of electronic PHI (ePHI).

How MyLÚA Handles Protected Health Information

MyLÚA Health operates as a Business Associate to covered entities, including health plans, payors, clinics, and healthcare organizations that deploy our platform to serve their members or patients.

Our platform is designed with data minimization as a core principle. The information a member shares through MyLÚA (including health logs, symptom reports, mood check-ins, and social needs) is stored with strict role-based access controls. Only the care team members explicitly authorized by the individual can view their data.

Aggregated and de-identified insights (such as population-level trend data shared with payors and employers) are processed to ensure they cannot reasonably be re-identified to any individual. This process complies with the HIPAA de-identification standard under 45 CFR § 164.514.

Technical Architecture and Security

MyLÚA Health operates a hybrid cloud architecture built on enterprise-grade managed infrastructure that provides scalability, isolation, and auditability. AI workflows are grounded in curated, evidence-based content through retrieval-augmented generation, not open-ended language model generation that could expose sensitive input data.

Data persistence relies on encrypted relational and in-memory data stores with strict role-based consent controls and tokenization. The architectural boundary between PHI and AI processing is enforced at the infrastructure level, ensuring that even in the event of a downstream compromise, PHI cannot be reconstructed from AI system logs or outputs.

Risk modeling for early detection of conditions such as postpartum depression is handled through separate machine learning pipelines, isolated from primary user-facing AI workflows. These signals are used to inform care support strategies and are not surfaced directly to care teams or users in a way that would constitute clinical diagnosis or advice.

Your Rights Under HIPAA

As an individual whose PHI may be handled by MyLÚA Health, you have the following rights under HIPAA:

• Right to Access: You have the right to inspect and obtain a copy of your PHI held by covered entities that use MyLÚA.
• Right to Amend: You have the right to request amendments to your PHI if you believe it is incorrect or incomplete.
• Right to an Accounting of Disclosures: You have the right to request a list of certain disclosures of your PHI.
• Right to Request Restrictions: You have the right to request restrictions on certain uses and disclosures of your PHI.
• Right to Confidential Communications: You have the right to request that your PHI be communicated to you through alternative means or at alternative locations.
• Right to Complain: You have the right to file a complaint with the U.S. Department of Health and Human Services if you believe your privacy rights have been violated.

To exercise any of these rights, please contact your healthcare provider or health plan directly, or email us at letsconnect@myluahealth.com.

Minimum Necessary Standard

MyLÚA Health adheres to the HIPAA Minimum Necessary Standard, which requires that access to PHI be limited to the minimum amount of information necessary to accomplish the intended purpose. Our platform enforces this standard technically through role-based access controls and programmatically through data minimization practices in our AI processing pipelines.

User Responsibility

Professional users (including doulas, care coordinators, clinicians, and organizational administrators) who access PHI through the MyLÚA platform are responsible for obtaining appropriate written authorization from the individuals whose data they access, in accordance with HIPAA and all other applicable law. MyLÚA Health's Terms of Service sets out these obligations in full.

Third-Party Subprocessors

MyLÚA Health may engage third-party service providers (subprocessors) who have access to PHI in connection with the provision of our services. All subprocessors are subject to appropriate Business Associate Agreements and are required to implement safeguards consistent with HIPAA requirements and our own security standards.

Contact and BAA Requests

If your organization requires a Business Associate Agreement with MyLÚA Health, or if you have any questions about our HIPAA compliance practices, please contact us at letsconnect@myluahealth.com.

For complaints regarding potential HIPAA violations, you may also contact the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr/complaints.

Privacy Policy · Terms of Service