Trust · 2026

What we do with your family's data

Trust pages usually collect badges. Ours collects facts: every vendor that touches the platform, whether it ever sees protected health information, and what agreement or engineering control stands in front of it — the same list our privacy policy discloses, in one table.

We run no ad trackers on care data — ever. Last reviewed July 23, 2026.

Trellis Care Coordination LLC

Who touches the data, and under what agreement?

Vendor	Role	Handles PHI?	Safeguard
Convex	Database and server runtime — the system of record for care data	Yes — under BAA	Signed BAA; encryption in transit and at rest
Vercel	Application hosting (front-end edge + serverless). No PHI is server-side rendered	Yes — under BAA	Signed BAA; care data is fetched client-side from Convex
Amazon Web Services	Intake-form OCR (Textract), clinical dictation (Transcribe Medical), telehealth video (Chime), transient encrypted storage (S3)	Yes — under BAA	Account-level HIPAA BAA covering the HIPAA-eligible services we use
Paubox	Transactional email (notifications, invitations, resets)	Yes — under BAA	Signed BAA; emails additionally formatted to avoid clinical PHI
Anthropic (Claude)	AI pattern insights and summaries	No	Receives only de-identified surrogate data — the 18 HIPAA identifiers are stripped before anything leaves our boundary — and is enrolled in Zero Data Retention
Stripe	Payment processing	No	Billing metadata only; a sanitizer enforces zero PHI at the API boundary
Sentry	Error monitoring (not currently enabled in production)	No	Error reports pass a dedicated PHI scrubber before transmission
Cloudflare	DNS management only (including the legacy trelliscare.app redirect)	No	Never proxies application traffic or terminates TLS — request content never reaches it
Google & Microsoft (calendar)	External calendar sync, only for users who explicitly connect one	No	Default opaque mode writes 'Mallowa appointment' with no PHI in title or description

This table mirrors the subprocessor disclosure in our privacy policy, which is the governing document.

How does AI work without seeing who you are?

Before anything reaches the AI provider, it passes a layered de-identification pipeline: pattern-based scrubbing strips the 18 HIPAA identifiers, real names and details are replaced with consistent surrogates so the text still makes sense, a separate machine-learning pass catches identifiers the patterns missed and redacts rather than blocks, and a single sealed gateway is the only place in the entire codebase that can call the AI provider at all — enforced at compile time and checked again by automated analysis on every change.

The AI provider receives de-identified surrogate text, operates under Zero Data Retention, and never trains on your data. That architecture — not a promise — is why the AI features don't require trusting the AI vendor with your family's identity.

What do we practice every day?

Access control on every query and mutation that touches care data — permission-checked server-side, per team member, per record.
An audit log of every read and write of protected health information — reads recorded server-side, in the same transaction that returns the record — surfaced to families in the disclosure log.
No PHI in URLs, logs, error reports, or server-rendered pages — care data travels client-to-database, encrypted in transit and at rest.
Per-note visibility controls, so a shared record never means everyone sees everything.
No advertising trackers on care surfaces, no sale of data, no third-party analytics inside the app.

Where are we on SOC 2?

SOC 2 Type II is on our roadmap and not yet underway — we publish this status honestly rather than implying certification we don't hold. What we practice today is listed below, verifiable in our legal pages.

The governing documents: Privacy policy · Consumer health data privacy · Security practices · HIPAA & BAA