Privacy

What is read, and where

The policy or evidence pack you paste is read in your browser to score it against the HIPAA Security Rule requirement text we hold. While you score it, it does not leave the browser and no copy is kept. A photograph you take is read in your browser the same way; the image never leaves it.

What is stored, and only when you save

When you save a mock audit, we store the text you pasted (as a record of the audit) and the score, under your account, so you can return to it. Nothing is stored until you press save. A saved audit is scoped to your account; one account cannot read another's saved work. You can delete one saved audit, or your whole account, yourself on your account page.

Where it is kept and who can see it

Pages are served by Cloudflare; saved work and accounts are held in Supabase in Sydney (AWS ap-southeast-2), encrypted at rest and in transit; payments are taken by Stripe; sign-in and receipt mail go through SendGrid. Those four are the only processors. Saved work is kept until you delete it or close your account. Support opens a saved record only at your request.

Sign-in and email

Sign-in is a one-time link sent to your email; there is no password. We send a receipt, and a sign-in link when you ask for one. We do not use tracking pixels or open tracking in those emails, and we do not add your pack to any marketing list without your explicit opt-in on this site.

Our statement, not a ruling

Every requirement shown is The Art of Service's statement of the HIPAA Security Rule clause, read against the copy we hold and cited to its clause, not the instrument verbatim. Mock HIPAA Audit scores the text you paste; it does not rule that a requirement is implemented or that your organisation is compliant. An assessor decides that.

Contact

Questions about your data: support@theartofservice.com. The Art of Service Pty Ltd, GPO Box 2673, Brisbane QLD 4001, Australia.