Security & Data Ownership
We don't just protect your data — we believe you own it. Green Path Health is built with security by design and patient data sovereignty at its core.
Full HIPAA compliance with administrative, physical, and technical safeguards. Business Associate Agreements with all infrastructure partners. Regular security audits and risk assessments.
All patient data is encrypted at rest using AES-256 encryption. All communications use TLS 1.3. Database connections are encrypted with SSL certificates.
Role-based access control (RBAC) ensures users only see data relevant to their role. Every access is logged in an immutable audit trail. Multi-factor authentication available for all accounts.
Your health data is yours — not ours, not AWS's, not anyone else's. You can export your complete medical record at any time. We maintain proprietary ownership controls that ensure your data remains yours even when hosted on cloud infrastructure.
Your rights
Every patient on Leafjourney has these fundamental data rights.
View all of your health data at any time through the patient portal. Complete chart access including notes, labs, messages, assessments, and care plans.
Download your complete medical record in standard formats (PDF, CCD/CDA). Print any document directly from the portal.
Request deletion of your data at any time. We comply with applicable state and federal data retention requirements, then permanently remove your information.
Request corrections to any inaccurate information in your medical record. Your care team will review and update accordingly.
Control who can access your data within the platform. Restrict sharing of specific records, notes, or documents.
Transfer your records to another provider seamlessly via HL7 FHIR interoperability standards. Your data moves with you.
Infrastructure
Hosting
Render (US data centers)
Database
PostgreSQL with encrypted connections
Authentication
Bcrypt-hashed passwords, iron-session cookies
API Security
Server-side validation, CSRF protection, rate limiting
Audit Trail
Immutable event log for all sensitive operations
Backups
Daily automated backups with point-in-time recovery
Monitoring
Real-time alerting for suspicious access patterns
Penetration Testing
Annual third-party security assessments