How we protect your family's health information
What is in place, and where your data goes when you use HealthVault365.
Who can see your records
- Sign-in by Microsoft Entra
- You sign in with your existing email account, so there is no new password to create. We send a one-time code to your email, and you use it to sign in. Sign-in is handled by Microsoft Entra, a sign-in service from Microsoft. Our server finishes each sign-in, so the access keys that reach your records stay out of your browser.
- Family records in your account
- You add family members and keep their records in your account.
- Files stay behind sign-in
- We do not hand out shareable links to your files. You sign in to view or download a file, and your access is checked each time.
- Flintarc staff and Microsoft
- A small number of Flintarc staff can reach the systems to run the service. Microsoft may review flagged content.
Where your data goes
- Runs on Microsoft Azure
- The service runs on Microsoft's cloud, with encrypted storage. Your documents and records are stored in New Zealand.
- AI on Microsoft Azure
- To read documents and answer questions, content is processed by Microsoft Azure AI services in the United States, because the AI models the service uses are not yet available in New Zealand.
How it is protected
- Encrypted when stored and sent
- Your documents and records are encrypted on Microsoft Azure when stored and when sent.
- Private network connections
- The database and file storage are closed to general internet access. Our services reach them over private connections, and the only other access is the restricted routes we use to run HealthVault365.
- Health information kept out of error records
- We write our error and activity records to leave out health information, and identify people and documents by ID instead.
Deleting your data
Deleting your account removes your data and your sign-in account from the service. Deletion is blocked while you manage family members or while documents are still processing. Copies, including your deleted sign-in account, can remain in encrypted backups, internal processing history and our sign-in directory for up to 35 days, and are then deleted automatically.
Have questions?
We are happy to answer them
Email us at support@healthvault365.com, or read the answers to common questions.