HIPAA

    HIPAA at Duo Practice. How we protect your patients' information.

    Duo Practice (duopractice.com) is built for practices that keep protected health information under HIPAA. There is no such thing as a “HIPAA certified” product: the government does not certify software. What we can do is tell you plainly what is in place today.

    Last updated October 3, 2026

    Safeguards

    6 of 6 in place

    • Encryption in transit and at rest

      Every connection to Duo runs over HTTPS (TLS). What Duo stores, in its database and its file storage, is encrypted at rest.

      In place

    • Access rules in the database itself

      Every table that holds practice or patient information has row-level security turned on, so access is checked by the database on each request, not only by the screens of the app.

      In place

    • Visit recordings deleted once transcribed

      A visit's audio is kept only until its transcript is saved. A weekly job then deletes the recording file. The transcript stays with the visit; recordings that have not been transcribed yet are never touched.

      In place

    • Hosting under a BAA

      Duo's database and file storage run on Supabase, which has signed a Business Associate Agreement with us.

      In place

    • Daily backups

      The database is backed up every day, so your records can be restored after a failure.

      In place

    • Business Associate Agreement

      We sign a Business Associate Agreement with every practice, by e-signature, before any patient information goes into Duo.

      In place

    Who does what

    • Your practice is the covered entity.

      You decide who sees your patients' information, and you give patients your Notice of Privacy Practices.

    • Duo Practice is your business associate.

      We handle your patients' information only to run the service for you. It is yours, and we do not sell it.

    • If you leave, your data leaves with you.

      When an account is closed, its data stays available to export for 30 days. After that it is deleted.

    Questions

    For a question about privacy or security, a request about your practice's data, or to report a concern, write to us at privacy@duopractice.com.

    How we handle account and usage information is in our privacy policy.