Trust center

Security and responsible data use

How records are protected

• Sign-in is required before accessing personal records.
• Every data request checks record ownership on the server.
• Photos use private object storage and are served only after an ownership check.
• Web traffic is encrypted in transit.
• Health data is not used for advertising or sold.

Security operations

Before paid launch, My ITP Journey will complete an independent security review, establish vulnerability reporting, document incident response, verify backups and recovery, and maintain a provider inventory.

Reporting a concern

A dedicated security contact will be added before paid launch. Do not include personal health information in an initial security report.