Trust Center: Security, Compliance & Uptime
CareLumi is built for compliance. HIPAA BAA available. SOC 2 Type II certified. 99% monthly uptime guarantee. Here's how we secure your data and maintain trust.
- HIPAA Compliant
- SOC 2 Type II Certified
- 99% Uptime Guarantee
Where AI alone falls short in healthcare, from administrative work to clinical workflows, see how CareLumi verifies the work .
Company information
- Company
- CareLumi, Inc.
- Location
- Chicago, Illinois, USA
- Industry
- Healthcare Compliance Software
- Contact for support, problems, and complaints
- support@carelumi.com
Contact us: support, problems, and complaints
One address reaches our team for everything. Whether you have a general support question, encountered a problem with the platform, want to report a security vulnerability, or need to raise a formal complaint, email support@carelumi.com. Every message is logged, acknowledged, and routed to the responsible owner.
Support requests
Questions about your account, a workflow, a document, or how something works. We respond during business hours, Monday through Friday.
Problems and service issues
Something is broken, slow, inaccurate, or not behaving as expected. Include what you were doing and what you saw, and we will investigate.
Complaints and escalations
Concerns about our service, our handling of your data, or a prior response. Complaints are tracked to resolution and reviewed by management.
Security vulnerabilities
Suspected vulnerabilities, unauthorized access, or anything affecting the confidentiality or integrity of customer data. We ask for reasonable disclosure time.
Privacy and data requests
Questions about how we collect, use, retain, or delete data, including access, correction, and deletion requests.
Documentation requests
Requests for a Business Associate Agreement (BAA), SOC 2 report, penetration test summary, or other compliance documentation.
You do not need an account to contact us. Anyone, including providers, patients, partners, and members of the public, may email support@carelumi.com to raise an issue or file a complaint.
AI safety and oversight
CareLumi is the verification layer for administrative and clinical AI. It operates with safeguards, expert oversight, and a full audit trail on every decision.
Agentic safeguards
CareLumi puts guardrails on every automated action, whether it comes from CareLumi, your tools or your AI agents, so decisions stay within defined, reviewable boundaries.
Technical AI-safety controls
CareLumi is built and reviewed against AI-safety controls appropriate for a regulated healthcare environment.
Expert review
The platform escalates to expert review when a confidence threshold is not met or a flagged item requires human judgment. Optional expert-review capabilities are a platform support and quality-control mechanism.
Auditability
Every decision, by people or AI, is logged, rule-verified, and reviewable, defensible for committees and auditors.
Regulatory currency
CareLumi is continuously updated as federal, state, and payer rules change, and checks work against the rules in force.
Standardization and reliability
One consistent standard across payers and states, because the system gates payment and patient care.
Certifications and frameworks we adhere to
HIPAA
CareLumi maintains full HIPAA compliance. We execute Business Associate Agreements with all customers.
SOC 2 Type I + Type II
Our SOC 2 Type I and Type II certifications provide independent verification of our security controls and operational practices.
Business Associate Agreement
BAAs are available for all customers. Our standard agreement covers all HIPAA requirements.
How we protect your data
- Encryption at Rest
- All data is encrypted at rest using AES-256 encryption. Database storage, file storage, and backups are all encrypted.
- Encryption in Transit
- All data between your browser and our servers uses TLS 1.3 encryption. API communications are encrypted end-to-end.
- Key Management
- Encryption keys are managed using Google Cloud KMS with automatic key rotation and audit logging.
- Role-Based Access Control
- Granular permissions ensure users only access data necessary for their role, with separate levels for admins, managers, and staff.
- Multi-Factor Authentication
- MFA is available for all accounts and required for administrative access, authenticator apps and SMS-based verification.
- Single Sign-On (SSO)
- Enterprise SSO via SAML 2.0 for seamless, secure authentication with your identity provider.
- Session Management
- Automatic session timeout after 30 minutes of inactivity. Sessions invalidate on logout and password change.
- Cloud Hosting
- Hosted on GCP in US-based data centers. GCP maintains SOC 2, ISO 27001, and HIPAA compliance.
- Network Security
- VPC isolation, Web Application Firewall (WAF), and DDoS protection via Google Cloud Armor.
- Data Redundancy
- Data replicated across multiple availability zones with regular automated backups and point-in-time recovery.
- Vulnerability Management
- Regular vulnerability scans and penetration testing, with automated security patching for infrastructure.
- Audit Logging
- Comprehensive audit trails for all data access, modifications, and administrative actions. Logs retained a minimum of 1 year.
- Security Monitoring
- 24/7 automated security monitoring with alerting, real-time threat detection, and response.
- Access Reviews
- Quarterly access reviews and automated deprovisioning when employees leave.
- Security Training
- All employees complete annual HIPAA and security awareness training, with role-specific training for those handling sensitive data.
- Background Checks
- Conducted for all employees with access to customer data and production systems.
- Acceptable Use Policy
- All employees acknowledge and adhere to information security and acceptable use policies.
- Vendor Management
- Third-party vendors are assessed for security practices, with data processing agreements in place with all subprocessors.
- Incident Response Plan
- Documented procedures for security events with a dedicated response team and defined escalation paths.
- Breach Notification
- Customers notified within 72 hours of confirmed incidents affecting their data, per HIPAA requirements.
- Business Continuity
- Disaster recovery procedures with defined recovery time and recovery point objectives (RTO / RPO).
Security documentation and policies
- Public
Privacy Policy
How we collect, use, and protect your personal information.
View PDF - Public
Master Service Agreement
Our standard MSA governing the terms of service for CareLumi customers.
View PDF - Request Access
Business Associate Agreement
Standard BAA for customers requiring HIPAA compliance coverage.
Request Access - Request Access
Data Processing Agreement
Terms governing how we process data on your behalf.
Request Access
Common questions about our security
Yes. We implement the administrative, physical, and technical safeguards required by the HIPAA Security Rule, and execute Business Associate Agreements (BAAs) with all customers.
All customer data is stored in GCP data centers located in the United States, across multiple availability zones for redundancy. Data is encrypted at rest with AES-256 and in transit with TLS 1.3.
Yes, we provide BAAs to all customers at no additional cost. Our standard BAA covers all HIPAA requirements. Contact support@carelumi.com to request one or discuss custom terms.
We maintain a documented incident response plan with a dedicated team. For incidents affecting customer data, we notify affected customers within 72 hours as required by HIPAA, and conduct post-incident reviews.
We retain your data for 30 days to allow export. After that, all customer data is securely deleted from production systems and backups within 90 days. Immediate deletion can be requested at any time.
Yes, annual third-party penetration testing by qualified security firms, plus regular vulnerability scanning. Penetration test summaries are available upon request with an NDA.
Email support@carelumi.com. This address is monitored for all inbound reports, including security vulnerabilities, product problems, service disruptions, data or privacy concerns, and formal complaints. We acknowledge every report and investigate promptly. For security vulnerabilities specifically, we ask for reasonable time to address the issue before public disclosure.