LifeOS - Compliance

Compliance

LifeOS is HIPAA-compliant and SOC 2 Type II certified, GDPR ready, with zero data retention for AI inference. It is built around US and EU healthcare data protection principles from day one, including data minimization and purpose limitation. The Privacy Policy, Security Policy, Master Commercial Agreement, and Impressum below each keep their own scope.

Last Updated: December 18, 2025

Privacy Policy

HIPAA-compliant. SOC 2 Type II certified. GDPR ready. Zero data retention for AI inference.

Effective Date: December 1, 2025

Last Updated: December 18, 2025

Security Policy

SOC 2 Type II certified. HIPAA-compliant infrastructure. Built for clinical-grade data protection.

Effective Date: December 1, 2025

Last Updated: December 18, 2025

Master Commercial Agreement

Effective Date: December 1, 2025

Last Updated: December 18, 2025

Document Version: 2.0

Impressum

Legal Disclosure / Information per § 5 TMG

Last Updated: December 18, 2025

Trusted by clinicians and medical partners

Need More Information?

Our security team is available to answer your questions and provide additional documentation.

Patient Vault™

Zero data retention

Encryption

Advanced permissions

HIPAA-ready

GDPR-compliant

ISO 27001

SOC 2 Type II

Domain verification

SAML single sign-on

Regional deploys

Audit logging

Contact Security Team

Questions on compliance

Who owns the patient data entered into HealthOS?

You retain strict ownership of all Protected Health Information (PHI). LifeOS Platforms, Inc. acts solely as a Business Associate. We do not own, monetize, or have independent rights to your patient records.

Who owns the patient data we process through HealthOS?

You retain full ownership of all Patient Data (PHI). LifeOS acts as a Business Associate, processing data solely to provide the service. All patient data lives in encrypted Patient Vaults™.

Security Policy

Do you use my patient data to train your AI models?

We never train our models on your Protected Health Information (PHI). As outlined in our Privacy Policy, we may use strictly de-identified, aggregated System Data (usage patterns, error rates) to improve platform accuracy, but your specific patient records remain private and are never fed into model training sets.

Is my patient data used to train your AI models?

We do not train our models on your Protected Health Information (PHI). Your clinical data is processed solely to generate your documentation and workflows, ensuring complete privacy and isolation.

Security Policy

What is the "Zero Data Retention" (ZDR) policy?

ZDR means that when our AI processes a Clinical Note or Prior Auth, the data is encrypted, processed for inference, and immediately discarded by the Model Provider. It is not stored, logged, or used to train third-party models.

Is LifeOS HIPAA compliant?

Yes. We are fully HIPAA-compliant and sign a Business Associate Agreement (BAA) with every customer. We also maintain SOC 2 Type II security controls, including AES-256 encryption and role-based access.

Is LifeOS HIPAA compliant?

Yes. We are HIPAA-compliant and sign a Business Associate Agreement (BAA) with every covered entity. We also maintain SOC 2 Type II controls and are GDPR-ready.

Security Policy

Do I need to sign a separate BAA?

No. The Business Associate Agreement (BAA) with LifeOS Platforms, Inc. is automatically incorporated as Exhibit B of the Master Commercial Agreement, covering your practice immediately upon activation.

Master Commercial Agreement

Can LifeOS employees access my patient records?

No. Your data is stored in dedicated "Patient Vaults™" with strict access controls. Our support and technical teams do not have access to decrypted patient records. Access is restricted exclusively to your authorized users.

Can LifeOS employees access my patient records?

No. Patient data is encrypted and stored in dedicated Patient Vaults™, which are technically inaccessible to our staff. Even our employees cannot access your decrypted patient records.

Security Policy

How long do you retain patient data?

We operate on a "Zero Data Retention" architecture for external AI models processing. Patient data is processed in real-time and explicitly not retained by our external AI inference providers. Your data lives in your secure workspace, and you control its lifecycle.

Security Policy

What happens to my data if I cancel my subscription?

You have a guaranteed right to data portability. Upon cancellation, you can export all patient data in a standard format (JSON/CSV) for 30 days. After this period, your data is permanently and securely deleted from our servers.

What happens if I cancel my subscription?

You retain full control. Clause 12.4 safeguards your right to export all Patient Data in standard formats (JSON/CSV) for 30 days post-termination, ensuring you never face vendor lock-in.

Master Commercial Agreement

Where is my patient data physically stored?

For US customers, data is hosted in AWS and Google Cloud US regions under HIPAA-aligned controls. For European customers, data is hosted in AWS eu-central-1 (Frankfurt) by default, supporting GDPR data-residency requirements.

Is data shared with third parties or data brokers?

Never. We do not sell data to brokers, advertisers, or third parties. We strictly prohibit the re-identification of data. Our business model is subscription-based, not ad-based.

Do you share data with third-party vendors?

We use a strictly vetted list of sub-processors (like AWS/GCP) who are also HIPAA-compliant and sign BAAs. We maintain a transparent list of all subcontractors and notify customers of any changes.

Security Policy

Which entity do I sign the Business Associate Agreement (BAA) with?

You contract directly with LifeOS Platforms, Inc. (USA). Our BAA is a standard component of the Master Commercial Agreement and is governed by US federal law (HIPAA), regardless of your location.

Impressum

Where should I send formal legal notices?

Formal legal notices should be sent via registered mail to our Dover, Delaware headquarters (listed above) with a digital copy sent to legal@lifeoslabs.com. General support inquiries should go to support@lifeoslabs.com.

Impressum