Purechart AI LLC
Security and data protection
Our policies describe how we protect the confidentiality, integrity, and availability of company, customer, patient, and consumer information.
Our policies
Read the full policies in English or download the original documents.
Information Security Policy
Effective March 2026 · Last reviewed September 2026
Access Control and Authentication Policy
Effective March 2026 · Reviewed at least annually
Data Retention and Disposal Policy
Effective March 2026 · Reviewed at least annually
Access and authentication
Access is based on least privilege, defined roles, business need, and Zero Trust principles. Unique accounts, secure passwords, and secure session management protect access. MFA is required for critical systems and sensitive environments where applicable. Shared credentials are prohibited except where technically necessary and specifically authorized.
Access reviews and revocation
Production access is restricted to authorized personnel and systems. Permissions are reviewed periodically and access is promptly modified or revoked when roles change, engagements end, or access is no longer required. Centralized identity management and automated provisioning and de-provisioning are used where supported and applicable.
Encryption and data protection
Communications use secure encrypted connections, including TLS 1.2 or higher where applicable. Sensitive data stored in supported systems and infrastructure is protected with appropriate encryption mechanisms. Access restrictions, audit logging, secure backups, and monitoring are applied where applicable.
Monitoring and incident response
Security-relevant access activity is logged and monitored where technically feasible. Suspected incidents are assessed, contained, investigated, remediated, and documented; affected services are restored where necessary. Notifications follow applicable legal, regulatory, and contractual requirements.
Secure development and integrations
Security risks are evaluated by likelihood and impact. Development practices may include code review, dependency monitoring, security testing, patching, and third-party penetration testing where appropriate. APIs and service accounts must use secure authentication, and credentials, tokens, and certificates must be protected.
Consumer financial information
Where authorized integrations, including Plaid, process consumer financial information, access is limited to authorized personnel and systems. We use encrypted communications, protect stored sensitive data where applicable, safeguard API credentials and access tokens, and limit collection and retention to legitimate business purposes. Appropriate notice and consent are provided where required.
Retention, disposal, and legal holds
Retention depends on the information and applicable healthcare, accounting, tax, audit, legal, contractual, and operational requirements. Information is securely disposed of at the end of its required retention period using methods appropriate to its sensitivity. Provider-held data follows documented provider procedures and applicable agreements. Records subject to a legal hold, investigation, audit, or litigation are preserved until the hold or requirement is released.
Governance and contact
Management oversees the security program. The technology and development team owns the security and access policies; management and the IT administrator own the retention policy. Policies are reviewed at least annually.
security@purechart.com