We are a pilot-stage program. We tell you exactly where we are on every compliance item — because your contracts team will ask and fabricating readiness is worse than being honest about the roadmap.
HIPAA-Eligible Infrastructure
Lambda, DynamoDB, Polly, and Bedrock are AWS HIPAA-eligible services covered under Amazon's BAA program. We say "HIPAA-eligible" not "HIPAA compliant" — compliance is a program, not a product feature. A signed AWS BAA must be executed before real PHI is stored; we have not done this for production yet. BAA available on health-plan contracts.
Infrastructure ready — BAA to execute
Crisis Protocol — 988 + Human Escalation
PHQ-9 item 9 above zero or risk language in conversation triggers immediate escalation: 988 Suicide & Crisis Lifeline delivered to the member, CRISIS-severity alert raised to the caregiver/plan dashboard, full audit log entry created. This is a hard design requirement, not a configurable option.
Live in care engine
Consent-First Architecture
The API gate refuses all health data writes without an explicit consent record on file. Consent is timestamped, scoped, and revocable. A right-to-erasure / purge workflow is on the production roadmap (consent withdrawal currently records the withdrawal but does not retroactively delete prior data).
Live — purge workflow roadmap
SOC 2 Type I
SOC 2 Type I is on our roadmap for the first payer contract. We do not have it yet. Our AWS architecture — scoped IAM roles, DynamoDB encryption at rest, append-only audit logging, HIPAA-eligible services — is designed to pass Type I controls. We will obtain Type I before going live with real member data at plan scale.
Roadmap — before plan scale
FDA General-Wellness / Non-Device Posture
We operate in the FDA general-wellness lane per the agency's January 6, 2026 guidance. We screen, track, engage, and route to humans — we do not diagnose, treat, or name conditions as findings. This keeps us non-device and satisfies the payer's crisis-escalation requirement simultaneously. A general-wellness posture memo is available for your compliance team on request.
Posture memo available on request
Clinical Governance (Named Advisor)
A named clinical advisor (MD or LCSW) governing screening thresholds, escalation rules, and outcome report methodology is a hard payer procurement requirement. We are actively recruiting this role. We will not claim it is filled until it is. This is the one item your compliance team will rightfully flag as a gap today — it is in progress.
In recruitment — required before plan contract