Trust

What we do with patient information

Oriva handles protected health information. This page sets out what we have built, and what we have not built yet, so your compliance team can assess us quickly rather than waiting on a questionnaire.

In place today

Each of these is a control we operate, not a certification we hold. Ask us how any of them works and we will show you.

Encryption

  • AES-256 at rest and TLS in transit, as provided by Google Cloud for Cloud SQL and Cloud Run.
  • Database connections are brokered by the Cloud SQL Connector, which mints short-lived credentials per connection rather than using a static password.

Secrets and deployment

  • Credentials are never baked into container images. They are pulled from Google Secret Manager when a process starts.
  • Our deployment pipeline authenticates through Workload Identity Federation, so there are no long-lived service-account keys stored in GitHub.

Data minimisation

  • The engine that ranks a differential runs on symptom answers, not on identity.
  • Phone numbers are reduced to their last four digits in application logs.
  • Voicemail guidance we publish tells practices never to ask callers to describe symptoms on a shared mailbox.

Ask us anything specific

A clause in the BAA, a control you need added, how we handle a particular kind of record. Email hello@oriva.health or book a call and you will speak to someone who knows the answer rather than a form.

What we can send you. A business associate agreement for your counsel to review, a written summary of the controls above, and direct answers to a security questionnaire. If a question on your list is something we have not built, we will say so in writing rather than leave it blank.

Questions we get

Will you sign a BAA?

Yes. Where Oriva handles protected health information on behalf of a practice, we act as a business associate and expect to sign a business associate agreement before any patient data moves. Ask us for the current template and we will send it along with the security summary. We would rather your compliance team read it early than discover a problem at signature.

Do you have SOC 2?

No, and we are not going to imply otherwise. SOC 2 is on our roadmap and has not been completed. Everything listed under what is in place on this page is a control you can verify by asking us how it works, not an audit result. If your procurement process requires SOC 2 today, we will not meet it yet.

Is Oriva a medical device?

No. Oriva gathers and organises what a patient reports so a dentist can decide faster. It does not diagnose, it does not prescribe, and it does not recommend treatment. Every clinical decision stays with your team. Our regulatory page sets out the reasoning in more detail.

Where is patient data stored?

In Google Cloud, in the United States. Practice and appointment records live in a managed Postgres database with encryption at rest and connections brokered through short-lived credentials rather than a shared static password.

Who at Oriva can see patient information?

Access is limited to the people who need it to operate and support the product. We are formalising role definitions and access reviews as we grow, and would rather describe that honestly than claim a maturity we have not reached yet. Ask us and we will tell you exactly who has access to what today.

Bring your compliance questions

Book a call with us and bring whoever needs convincing. We would rather answer hard questions early than discover a blocker at signature.