Built for healthcare, designed for trust.

We never train AI models on identifiable patient data. Under our BAA, we may de-identify data to HIPAA standards and use de-identified data to improve our products and support clinical research. We never sell identifiable patient data. PHI is shared only with subprocessors bound by BAAs, and only to deliver our services.

All data is stored in US-based AWS data centers. We use private VPCs (Virtual Private Clouds) with network isolation, encryption at rest using AES-256, and encryption in transit using TLS 1.3. Data never leaves US jurisdiction.

Contact us at [email protected] to initiate the BAA process. We provide standard BAAs that comply with HIPAA requirements. The process typically takes 1-2 business days to complete.

We notify affected customers within 72 hours of discovering a breach of their data, and provide a full written report within 15 days, as set out in our BAA. Our incident response team contains the issue, investigates the cause, and remediates. We maintain cyber liability insurance and documented incident response procedures.

Access to patient data is strictly limited to authorized personnel who require it for support purposes, and all access is logged in immutable audit trails. We implement role-based access control (RBAC) and least-privilege principles. No one at Mira Health can access your data without proper authorization and a documented business need.

By default, we retain audio, transcripts, and notes for 7 years to comply with healthcare record-keeping requirements. However, retention periods are configurable based on your organizational policies, including deleting audio immediately after a note is finalized. You can request deletion of your data at any time, and we will permanently remove it within 30 days.

We maintain HIPAA compliance and sign Business Associate Agreements (BAAs) with all customers handling PHI. We conduct regular security assessments and penetration testing. Our infrastructure runs on AWS, which maintains SOC 1/2/3, ISO 27001, and HIPAA certifications. We are working toward SOC 2 with Vanta.

Yes. We are happy to participate in security reviews, complete security questionnaires (SIG, CAIQ, custom), and provide documentation of our security practices. Contact us at [email protected] to schedule a security review call.