UpThera trust center
Security and data handling
A clear view of how the public site, sample workspace and facility accounts differ. This page describes product controls; it is not a HIPAA certification or a substitute for your organization’s security review.
Public inquiries
Pricing and demo requests ask for business contact details. Please do not enter patient information in these forms. A facility should use an approved clinical channel for any patient-related discussion.
Sample workspace
The sample workspace uses fictional cases and an individual, time-limited signed session. Treatment and follow-up edits remain in the browser session and are not written to a facility’s clinical records. Reloading resets those edits; some display preferences may stay on the device.
Facility accounts
Real users authenticate through Supabase Auth. The application uses facility and role checks, database row-level security, and audit records for selected actions. Access must also be verified in the facility’s own deployment and user-provisioning process.
Encryption and integrations
The site uses HTTPS in its deployed configuration. The optional EHR workflow encrypts its short-lived server-side context with a separate deployment key. UpThera is not described as end-to-end encrypted: the application must process authorized data to provide its workflows. At-rest encryption, backups and key custody need deployment-specific verification.
Before clinical data is enabled
A healthcare deployment requires review of data flows, vendor agreements and BAAs where applicable, a HIPAA security risk analysis, access and audit operations, retention, incident response, backup recovery and the facility’s approval. UpThera does not claim a blanket HIPAA-compliant or SOC 2 certified status here.
Discuss your IT requirements