Dermvio← Back

Dermvio

Security

Effective 2026-06-10

Draft — pending counsel review

This page is a placeholder while Dermvio finalizes its policies with healthcare counsel. The final version may differ in material respects. Do not rely on this text for legal purposes.

Dermvio is built for HIPAA-grade telehealth. This page summarizes how we protect patient and provider data. If you need additional detail to satisfy a compliance review, contact security@dermvio.com— we'll share a full security questionnaire response, our BAA template, and our subprocessor list.

HIPAA program

Dermvio acts as a Business Associate to the dermatologists and clinics that use the platform. Every dermatologist and every clinic on Dermvio signs a Business Associate Agreement before accepting any patient data through the Service. Our security program is designed against the HIPAA Security Rule and is updated as our infrastructure evolves.

Data classification

  • PHI — patient identifiers, photos, chief complaints, treatment history, messages. Stored only inside our HIPAA-compliant infrastructure; never sent to non-BAA services, never written to operational logs.
  • Provider PII — license numbers, NPI, malpractice certificates. Restricted to credentialing personnel; access logged.
  • Operational data — non-sensitive metadata used to run the Service (page views, request IDs, error traces). Excludes PHI.

Encryption

  • In transit: TLS 1.2 or higher on all endpoints. HTTP Strict Transport Security on the apex and all subdomains.
  • At rest: AES-256 on databases and object storage. Cloud Storage objects use Google-managed encryption keys (CMEK available on request for clinic plans that require it).
  • Field-level encryption for the most sensitive fields (e.g., where applicable) using authenticated encryption.

Access controls

  • Role-based access: patient, provider, clinic admin, platform admin. Authorization is checked at the API layer for every request.
  • Multi-tenant isolation: a provider can only access their own patients; a clinic admin can only access providers in their own clinic. Cross-tenant queries are blocked at the data layer, not just the application layer.
  • MFA enforced on the underlying identity infrastructure (Firebase Identity Platform). Stronger MFA policies are available for clinic plans.
  • Internal Dermvio staff access is least-privilege, time-bound, and recorded.

Audit logging

Every access to PHI is recorded in an append-only audit log: who accessed what, when, from where, and what action they took. Clinic admins can view their own clinic's audit log; platform admins can view the global log. Audit records are retained for at least six years to meet HIPAA requirements.

Infrastructure

  • Hosted on Google Cloud Platform (us-central1), inside a dedicated HIPAA-eligible project with a signed BAA.
  • Application servers run on Cloud Run with private VPC networking; databases run on Cloud SQL with automated backups and point-in-time recovery.
  • Photo and document storage is in Cloud Storage with block-all-public-access, signed-URL-only access, and object-level KMS encryption.

Subprocessors

Dermvio uses the following subprocessors. All are bound by a BAA where applicable:

  • Google Cloud Platform — compute, database, storage
  • Firebase Identity Platform — authentication
  • Stripe — payments and payouts
  • Resend — transactional email (no PHI in email bodies)
  • Sentry — error monitoring (configured to scrub PHI)
  • DocuSign — legal agreement execution

Material changes to this list are communicated to clinics in advance.

Vulnerability management

  • Dependency scanning on every commit and continuous monitoring for newly disclosed CVEs.
  • Code review on every change; automated tests for access control on every PR that touches PHI surfaces.
  • Regular third-party penetration testing is planned ahead of general availability.

Incident response

Dermvio operates a documented incident response process, including 24-hour notification of any confirmed Breach (as defined by HIPAA) to the affected dermatologist or clinic in accordance with the BAA. Report security issues to security@dermvio.com.

Responsible disclosure

We welcome reports from security researchers. Send findings to security@dermvio.com — please do not test against real patient data. We do not currently offer a bounty program but will publicly credit contributions on request.

Compliance summary

  • HIPAA Privacy and Security Rule — designed against
  • SOC 2 Type II — roadmap, post-launch
  • State telehealth requirements — tracked per provider state of licensure

Questions

Compliance officers and security teams can request our latest security questionnaire response, BAA template, and architecture summary at security@dermvio.com.