Trust Center

    Duo Practice Trust Center. What protects your practice's data, and how to reach us.

    Duo Practice (duopractice.com) is the software dietitians use to chart, schedule, record visits and bill insurance. This page lists the security controls in place today. When something changes, this page changes with it.

    Last updated October 3, 2026

    Compliance

    HIPAA

    Duo is built for practices that keep protected health information under HIPAA, and signs a Business Associate Agreement with every practice. 6 of 6 safeguards are in place. HIPAA has no certification: the government does not certify software.

    HIPAA at Duo Practice

    Controls

    7 of 7 in place

    Data protection

    • Encryption in transit and at rest

      Every connection to Duo runs over HTTPS (TLS). What Duo stores, in its database and its file storage, is encrypted at rest.

      In place

    • Visit recordings deleted once transcribed

      A visit's audio is kept only until its transcript is saved. A weekly job then deletes the recording file. The transcript stays with the visit; recordings that have not been transcribed yet are never touched.

      In place

    Access control

    • Access rules in the database itself

      Every table that holds practice or patient information has row-level security turned on, so access is checked by the database on each request, not only by the screens of the app.

      In place

    • Private file storage

      Files that carry patient information, such as visit recordings, insurance cards and lab documents, are kept in private storage. They have no public address; the app opens each one through a link that expires.

      In place

    Infrastructure

    • Hosting under a BAA

      Duo's database and file storage run on Supabase, which has signed a Business Associate Agreement with us.

      In place

    • Daily backups

      The database is backed up every day, so your records can be restored after a failure.

      In place

    Agreements

    • Business Associate Agreement

      We sign a Business Associate Agreement with every practice, by e-signature, before any patient information goes into Duo.

      In place

    Contact

    For a question about privacy or security, or a request about your practice's data, write to us at privacy@duopractice.com. If you think you have found a security problem in Duo, tell us there too.

    Report a security concern

    How we handle account and usage information is in our privacy policy.