Security Overview

Platform Overview

Health of Your Space provides a cloud-based platform used by orthodontic practices to manage patient intake workflows, communications, workflow automation, patient engagement, analytics, payment-related workflows, and administrative processes.

The platform may process sensitive information, including patient intake data and protected health information (PHI), on behalf of healthcare providers.

Healthcare providers remain the controllers of patient data, while Health of Your Space operates as a data processor and HIPAA Business Associate for U.S. healthcare providers.

Dolphin Management Architecture

Health of Your Space is designed to operate alongside Dolphin Management, which serves as the primary system of record for patient and practice information.

Health of Your Space functions as a system of engagement that facilitates patient interactions, workflow automation, communications, reporting, analytics, payment-related workflows, and administrative processes while synchronizing information with Dolphin Management where applicable.

Where operationally necessary, Health of Your Space may temporarily process, transmit, synchronize, cache, back up, or store information required to provide the Services, maintain platform functionality, support business continuity, or facilitate integrations.

Infrastructure Security

Health of Your Space operates on secure cloud infrastructure providers designed to meet modern security and reliability standards.

Infrastructure protections include:

• secure cloud hosting environments
• network-level security controls
• continuous system monitoring
• protected data transmission channels
• infrastructure redundancy and reliability safeguards

Infrastructure services are provided through trusted cloud platforms designed to support high levels of availability and security.

Data Location and Hosting

Health of Your Space is hosted on secure cloud infrastructure operated by trusted cloud providers.

Platform data is primarily stored and processed in the United States using secure cloud hosting environments.

Health of Your Space currently uses Amazon Web Services (AWS) as its primary cloud infrastructure provider.

Health of Your Space may also utilize trusted third-party service providers for messaging delivery, email delivery, authentication, payment-related workflows, monitoring, analytics, operational support, and related services.

Healthcare providers using the platform understand that data submitted to the Services may be transmitted to and stored in the United States or other jurisdictions where service providers operate.

Where required by applicable privacy laws, appropriate safeguards are used to support cross-border data transfers.

Security Practices

Health of Your Space follows industry-standard security practices designed to protect sensitive healthcare and patient information.

Key practices include:

Access Controls

Access to Health of Your Space systems is limited to authorized personnel and controlled through secure authentication practices.

Security measures include:

• authenticated user accounts
• authenticated staff, patient, and intake sessions
• one-time code verification for intake and the patient portal
• role-based permissions
• restricted administrative access
• an activity audit log of staff, patient, and system actions

Only authorized individuals may access systems that process or store sensitive data.

Data Protection

Health of Your Space implements safeguards designed to protect patient and provider data.

These safeguards include:

• encrypted data transmission
• encrypted data storage
• controlled access to sensitive systems
• monitoring and logging of system activity
• secure system configuration and infrastructure management

Analytics and website usability tools used on the public marketing website are not used within the application environment where patient or provider data is submitted or processed.

Healthcare providers maintain control over the data submitted to the platform and determine how patient data is used within their clinical workflows.

Healthcare providers remain responsible for determining the content of custom forms, disclosures, consents, questionnaires, workflows, communications, and other provider-configured content created through the Services.

Health of Your Space personnel do not access patient data except when necessary to provide technical support at the request of the healthcare provider, maintain the Services, or comply with legal obligations.

Messaging and Communications

Health of Your Space supports patient communications through messaging tools such as SMS and email notifications.

These communications may be delivered through trusted third-party messaging providers.

Healthcare providers remain responsible for determining the appropriate use of messaging features and ensuring compliance with applicable laws and professional standards.

Messaging tools should not be used for emergency communications or urgent medical situations.

Payment Workflows

Health of Your Space may facilitate payment-related workflows through third-party payment providers.

Payment credentials are collected and processed through third-party payment infrastructure. Health of Your Space does not store raw payment card numbers, CVV values, or full bank account credentials.

Health of Your Space may receive tokenized payment references and limited payment metadata necessary to support payment-related functionality.

Compliance

Health of Your Space is designed to support healthcare providers in maintaining compliance with applicable privacy and security regulations.

While the platform may include features intended to support privacy, security, documentation, workflow, operational, or regulatory requirements, Health of Your Space does not guarantee Customer compliance with HIPAA, HITECH, GDPR, PIPEDA, COPPA, TCPA, CAN-SPAM, state privacy laws, professional standards, licensing requirements, or other legal obligations.

Depending on the jurisdiction of the healthcare provider, these may include:

• Health Insurance Portability and Accountability Act (HIPAA)
• Health Information Technology for Economic and Clinical Health Act (HITECH)
• Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA)
• General Data Protection Regulation (GDPR) where applicable

For U.S. healthcare providers, Health of Your Space operates as a Business Associate and executes a Business Associate Agreement (BAA) where required.

Third-Party Providers

Health of Your Space relies on trusted third-party providers to support certain platform functions.

These may include providers for:

• cloud infrastructure
• messaging delivery services
• email delivery services
• authentication services
• monitoring and operational support
• payment service providers
• analytics providers

These service providers are required to maintain appropriate security safeguards and confidentiality obligations.

Additional information about service providers may be available upon request.

Data Ownership and Control

Healthcare providers retain ownership and control of the patient information collected through the Health of Your Space platform.

Health of Your Space processes patient information solely on behalf of healthcare providers in order to deliver the Services. Providers determine what data is collected, how it is used within their clinical workflows, and how long it is retained.

Health of Your Space does not use patient information for advertising or marketing purposes and does not sell patient data.

Shared Responsibility Model

Security is a shared responsibility between Health of Your Space and the healthcare providers who use the platform.

Reporting Security Issues

If you believe you have discovered a potential security vulnerability involving the Health of Your Space platform, please notify us promptly.

Security Documentation

Healthcare organizations that require additional security documentation or have questions about the security practices used by Health of Your Space may contact us using the information above.