Your data, your rules
Your clinic owns its records. You set retention, export everything any time, and we never sell it or share it without your approval or a court order.
Trust center
The hard questions about your clients' privacy, answered up front.
Clinics trust us with health information, so we build to the same security requirements Freedom Technology Partners follows for defense, first-responder, and emergency-services clients, plus the rules written for health care.
Our commitments
What we promise every clinic.
We sign a BAA
Every clinic gets a Business Associate Agreement, and every vendor that touches health information signs one with us: hosting, phones and texting, and AI.
Government-grade security
Multi-factor sign-in, encryption, least-privilege access, and a log of every time someone opens a chart. The same practices we use for defense and public-safety work.
Vetted people
Our staff with access to systems that hold client information are U.S.-based and background-checked to FBI CJIS Security Policy standards.
A person decides
The AI drafts notes and answers routine questions. A practitioner reviews and signs every note, and visits are recorded only when the client agrees.
No long-term contracts
Month to month. If you leave, you take a full export of your clients, notes, and history with you, at no charge.
Standards we build to
Health-care rules plus government security frameworks.
We describe the safeguards we use rather than stamp a badge on the page. Your compliance program is yours; we give you the tools, the agreements, and the records to support it. This page is not legal advice.
- HIPAA Privacy, Security, and Breach Notification Rules, and the HITECH Act.
- NIST SP 800-66, the government's guide to the HIPAA Security Rule.
- NIST SP 800-171 and CMMC practices we follow for defense clients.
- FBI CJIS Security Policy background checks for our people.
- PCI DSS through Square and Stripe: card numbers never reach our servers.
- TCPA and carrier 10DLC rules for texting: consent, quiet hours, and STOP.
- VA Community Care handling: authorization numbers are never stored or logged.
- WCAG 2.1 AA accessibility for client booking.
- State privacy and medical-records laws where your clinic operates.
- Hosting with SOC 2 Type II and ISO 27001 reports and U.S. data storage.
How it works
The safeguards inside Freedom Practice.
Encryption
TLS on every connection. Client contact details, messages, notes, and photos are encrypted again field by field with AES-256-GCM, tied to your clinic.
Role-based access
Owners, managers, front desk, billing, and practitioners each see only what their job needs. A practitioner sees other practitioners' visits as busy time, not names.
Two-step sign-in
Passwordless codes for everyone, plus an authenticator app for owners and managers. Sessions end on their own.
Audit log
Who opened which chart, changed a visit, downloaded a claim, or exported data, and when. Kept for six years.
No health details in logs
System logs carry ids only. Automated checks reject any change that would log a name, phone number, or note, and scan every change for leaked keys.
Separate clinics
Every clinic's data is walled off from every other clinic's, and our demo runs on made-up people only.
Backups and recovery
Encrypted backups with point-in-time restore, monitored around the clock, and a written plan for outages.
Incident response
A tested response plan, and notice to your clinic quickly if your clients' information is ever involved, so you can meet your own HIPAA deadlines.
Yearly risk assessment
We review our safeguards every year, and give you the records you need for your own HIPAA risk analysis.
Questions we hear
Straight answers.
For clinic owners
Who owns our client records?
You do. We hold them for you under a BAA, and you can export everything at any time, in standard formats, at no charge.
Will you sign our BAA, or do we sign yours?
Either. We have a standard Business Associate Agreement, and we review a clinic's own agreement when it has one.
What happens to our data if we cancel?
You get a full export. We keep your records for 30 days in case you change your mind, then delete them, except where the law requires us to keep something longer.
Are calls and texts with clients kept?
Yes, on each client's history, encrypted, and visible only to staff who can see that client. You choose whether calls are recorded, and callers hear a notice when they are.
For practitioners
Can other practitioners read my clients' notes?
Not unless the owner gives them access. By default you see your own clients; other visits show as busy time.
How does the AI scribe handle a visit?
Only with the client's consent. It drafts a note for you to review, and the draft cannot be used until you check it and sign. Client information is never used to train public AI models.
For your clients
Is my card stored by the clinic?
No. Card details go straight to the clinic's processor, Square or Stripe. The clinic sees only the card brand and last four digits.
Who can see my intake answers and notes?
Your practitioner and the clinic staff whose job needs them. Every time someone opens your chart, it is logged.
How do I stop texts?
Reply STOP to any text. Appointment reminders and marketing are separate, and marketing is only sent if you agree to it.
For IT and compliance
Where is data stored?
In U.S. data centers run by providers with SOC 2 Type II and ISO 27001 reports, under BAAs. Health information is not sent to public AI services or chatbots.
Do you support single sign-on and passkeys?
Passwordless codes and authenticator apps are in place today. Passkeys and single sign-on with your Microsoft or Google workspace are on the roadmap; ask us and we'll put a date on it.
Can we review your security documents?
Yes. We share our security overview, BAA, and risk-assessment summary under NDA. Email info@freedomtech.us.
See it for yourself.
Explore the demo clinic, made up from top to bottom, or start a 14-day free trial.