This page exists because your hospital’s procurement team will ask for it, and because a caregiver deciding whether to type something honest into a chat deserves to know the answer first.
If your employer, your hospital or a nonprofit funds your access to Rezilia, they receive aggregated and anonymized cohort metrics. Engagement rates, distribution of mental load, share of the cohort in an elevated risk band, trends over time. Never a name, never a message, never an individual score.
Cohorts below a minimum size are suppressed, so nobody can be identified by elimination in a small team. This is a property of how the system is built, not a checkbox someone could turn off during an implementation call.
If a vendor can show a manager one employee’s wellbeing score, the architecture is wrong.
Production runs on a HIPAA compliant Azure landing zone with hub and spoke isolation across two US regions.
Encrypted in transit with TLS 1.2 or above, and encrypted at rest with platform managed keys.
Role based access, least privilege, and audited administrative actions. Engineers do not browse family data.
A Business Associate Agreement is available for covered entities and their business associates.
Epic native integration over FHIR R4 with SMART Backend Services, scoped and consented per deployment.
The public marketing site runs outside the HIPAA boundary, in its own subscription, with no path into the clinical environment.
These are not favours we grant. They are how the product is built.
Crisis language. Explicit crisis language does not go into the load model and wait for a trend. It triggers a separate, fast escalation path with clinician reviewed logic, which surfaces professional resources rather than an AI reply. Treating a crisis as a data point would be dangerous.
Free text. The family chat is the richest signal the platform reads, which is exactly why it is the most protected. It is processed to produce a score for the caregiver themselves. It is never surfaced to an organization, never used to train a general model, and never sold.
We complete security questionnaires directly, before contract, under NDA. Write to connect@taloshealth.ai.
Not yet. SOC 2 Type I is targeted for the fourth quarter of 2026 and the work is under way. We would rather tell you the date than imply a certificate we do not hold.
Yes, for covered entities and business associates. It is part of the standard contract path for health system and health plan deployments.
The list, with purpose and location for each, is shared under NDA and updated when it changes. Core infrastructure is Microsoft Azure.
Production data for US deployments stays in US regions. European deployments are scoped separately and the data residency question is answered in writing before contract.
We do not sell data and we do not use identifiable family content to train general purpose models. The semantic layer learns within the product, and the scope is written into the contract.
We have an incident response process with defined notification timelines that meet HIPAA breach notification requirements, and the runbook is available for review during procurement.
Security packs, subprocessor lists and data flow diagrams, before contract.