Security & Trust

Last updated: 19 June 2026

HJachi handles some of the most sensitive information there is. Security here isn't a feature bolted on at the end - it's the architecture. This page summarises how we protect health information and how practices can put a Business Associate Agreement in place before processing any protected health information (PHI).

1. Our approach

Two questions decide every design choice: does this protect the person, and does it keep their data where it belongs? We minimise what we collect, keep the most sensitive processing on the Provider's own device, and encrypt everything else - so a breach of any single layer does not expose readable clinical content.

2. On-device by default

When a session is recorded, the audio never leaves the Provider's device. Speech-to-text runs locally on-device (whisper.cpp). Only the resulting text transcript is uploaded, and only after the Provider confirms it; the audio recording is then deleted. We never send session audio to a third-party transcription vendor.

3. Encryption

In transit: all traffic is encrypted with TLS (HTTPS / WSS).
At rest: the database (AWS RDS) is encrypted with a dedicated, rotated AWS KMS key; file storage uses S3 server-side encryption with KMS (SSE-KMS).
Telehealth media is carried over encrypted, peer-authenticated channels.

4. Access & monitoring

Authentication is handled by a managed identity provider (AWS Cognito) with support for strong, modern sign-in.
Least-privilege access controls and scoped deploy roles across our infrastructure.
Audit logging and timestamps on sensitive actions.
A web application firewall (WAF) protects the public API.

5. Consent & immutable records

Consent is enforced before every recorded session - in the app, the API, and the UI. No consent on file, no recording.
Signed clinical notes are immutable; any later change is tracked as a separate amendment rather than overwriting the record.
Push notifications never contain PHI - they carry opaque identifiers resolved only inside the authenticated app.

6. Sub-processors

We use a small set of vetted infrastructure providers, each under contract and confidentiality obligations, and - where they may handle PHI - under a Business Associate Agreement. The current list is maintained in our Privacy Policy.

7. HIPAA & Business Associate Agreements

When you use HJachi to create, receive, maintain, or transmit PHI, your practice is the covered entity and HJachi acts as your business associate. We make a Business Associate Agreement (BAA) available to every practice that handles PHI. A practice should have a BAA in place with us before processing PHI - you can request one at legal@hjachi.com.

A BAA is counter-signed on request - email legal@hjachi.com and we'll send it for signature.

8. Compliance alignment

HJachi is built to align with the major health-privacy regimes - HIPAA (US), PIPEDA and provincial law (Canada), India's DPDP Act, and GDPR (EU/EEA). Alignment is an ongoing programme, not a one-time certificate; this page and our Privacy Policy are kept current as it evolves.

9. Responsible disclosure

If you believe you've found a security vulnerability, please tell us before disclosing it publicly. Email security@hjachi.com with enough detail to reproduce the issue. We'll acknowledge your report, investigate, and keep you updated. We will not pursue good-faith research that respects user privacy and avoids degrading the service.

10. Breach notification

In the event of a security incident affecting personal information or PHI, we will investigate, contain, and notify affected practices and authorities as required by applicable law and by our Business Associate Agreements, without undue delay.

11. Contact

Security questions: security@hjachi.com. BAA and legal: legal@hjachi.com. General: contact@hjachi.com.

HJachi is operated by Hjachi Inc. (British Columbia, Canada). Telephone +1 (778) 902-4072.

This page is a clear-language summary of our practices and should be reviewed by your legal and security counsel before you rely on it contractually.