Security at Wellness Projection Lab
Enterprise-grade security to protect your most sensitive health information
Last updated: December 27, 2025
Your Data is Safe With Us
We use AES-256 encryption at rest, HTTPS (TLS) in transit, HIPAA-aligned controls, and role-based access to ensure your health data remains private and secure.
Security Overview
At Wellness Projection Lab, security is not an afterthought—it's built into every layer of our platform. We understand that you're trusting us with your most sensitive health information, and we take that responsibility seriously.
Encryption in transit and at rest
Data is encrypted on its way to us (HTTPS) and while it is stored (AES-256)
HIPAA-Aligned
Built to align with the HIPAA Privacy and Security Rules
Ongoing Review
Regular internal security review and dependency scanning; third-party audits planned as we scale
Data Encryption
🔐 Encryption at Rest
All stored data is encrypted using AES-256 encryption, the same standard used by banks and government agencies.
- Google Cloud encrypts stored data by default (Google-managed keys)
- File storage encryption for meal photos and documents
🌐 Encryption in Transit
All data sent between your device and our servers is encrypted with HTTPS (TLS).
- HTTPS-only connections (HSTS enforced)
- Encrypted real-time data sync (Firestore listeners)
Infrastructure Security
Google Cloud Platform
Your data is stored on Google Cloud (Firebase). Google Cloud offers a HIPAA Business Associate Agreement (BAA). The app itself runs on Vercel.
🖥️Server Security
- •Minimal attack surface (least privilege)
💾Database Security
- •Encrypted connections only
- •Automated backups every 6 hours
- •Point-in-time recovery
Application Security
Secure Development Lifecycle
Code Security
- •Automated security regression tests and dependency audit
- •Security-focused code reviews
- •Dependency scanning and updates
- •Code linting (ESLint)
Input Validation
- •SQL injection prevention
- •XSS (Cross-Site Scripting) protection
- •CSRF token validation
- •Request rate limiting and throttling
API Security
- ✓OAuth 2.0 and JWT authentication
- ✓Rate limiting per endpoint
- ✓Audit logging of record changes
Access Control & Authentication
🔐User Authentication
- ✓Biometric authentication (Face ID, Touch ID via WebAuthn)
- ✓Session timeout after inactivity
👥Role-Based Access
- ✓Principle of least privilege
- ✓Granular permission controls
- ✓Separate admin and user roles
- ✓Family member access controls
- ✓Provider access management
- ✓Access revocation workflows
Security Monitoring & Incident Response
Security Monitoring
- •Continuous monitoring with rule-based anomaly detection
- •Google Cloud audit logging and alerting
- •Rate limiting and automatic session timeout
Incident Response
We maintain a documented incident-response process:
Who responds
- •Founder-led incident response
- •Documented response runbook
- •Google Cloud security tooling and alerts
Response Process
- •Prompt triage and investigation
- •Containment and remediation
- •User notification within 72 hours (if required)
Breach Notification
In the unlikely event of a data breach affecting your personal information, we will notify you within 72 hours as required by HIPAA and GDPR. We will provide clear information about what happened, what data was affected, and what steps we're taking to prevent future incidents.
Our Security & Privacy Practices
We are built to healthcare-grade security standards and designed to support compliant care. We do not currently hold third-party certifications such as SOC 2 or ISO 27001.
Built for HIPAA workflows
Controls aligned with the HIPAA Privacy and Security Rules
- ✓Privacy Rule–aligned access controls
- ✓Security Rule–aligned safeguards
- ✓Audit logging of health-record changes
Encryption & infrastructure
Encrypted in transit and at rest on Google Cloud
- ✓AES-256 encryption at rest
- ✓HTTPS (TLS) in transit, HSTS enforced
- ✓Automated, encrypted backups
Access & audit controls
You decide who sees what, and changes to health records are recorded
- ✓Role-based caregiver permissions
- ✓Audit logging of record changes
- ✓Automatic session timeout
GDPR-aligned practices
Privacy-by-design principles for all users
- ✓Data protection by design
- ✓Data export on request
- ✓Data deletion on request
Third-Party Security
These are the outside services that run WPL:
Vendor Security Requirements
- •SOC 2 Type II certification required
- •HIPAA Business Associate Agreements (BAAs)
- •Data Processing Agreements (DPAs)
- •Ongoing monitoring and review
Key Third-Party Partners
Security Best Practices for Users
While we implement robust security measures, you can help protect your account:
Do:
- ✓Enable biometric sign-in (Face ID / Touch ID)
- ✓Use a strong, unique password
- ✓Enable biometric authentication
- ✓Review account activity regularly
- ✓Log out from shared devices
- ✓Keep your app updated
Don't:
- ✗Share your password with anyone
- ✗Use public Wi-Fi without VPN
- ✗Click suspicious links in emails
- ✗Reuse passwords from other sites
- ✗Disable security features
- ✗Ignore security alerts
Vulnerability Disclosure Program
We welcome responsible disclosure of security vulnerabilities. If you believe you've found a security issue, please report it to us:
Responsible Disclosure
Please do not publicly disclose the vulnerability until we've had a chance to address it. We appreciate security researchers who responsibly disclose issues and are glad to offer recognition for valid reports.
Security Questions?
If you have questions about our security practices or would like more information: