HIPAA at Miravio

The Health Insurance Portability and Accountability Act (HIPAA) sets the standard for protecting sensitive patient data. Miravio, a product of Antitropy LLC, handles protected health information (PHI) on behalf of the clinics and practitioners who use the platform. This page describes the safeguards that exist in the product today. We keep it factual: every statement here is verifiable in our codebase or in the linked infrastructure documentation, and we update it as new controls ship.

1. Encryption in transit and at rest

• In transit: all traffic between your browser and Miravio is served over HTTPS (TLS). Connections from the application to the database are TLS as well.
• At rest: Miravio's database, file storage, and backups run on Supabase, whose published security documentation states that all customer data is encrypted at rest with AES-256 and in transit via TLS.

Published evidence for the infrastructure claims above:

• Supabase security overview: States that all customer data is encrypted at rest with AES-256 and in transit via TLS, and that Supabase is SOC 2 Type 2 compliant.
• Supabase HIPAA projects guide: Describes the signed BAA plus HIPAA add-on required before storing PHI, and the High Compliance project configuration we apply to production.
• Supabase shared responsibility model: Defines which HIPAA safeguards Supabase provides and which we implement in the application layer, as documented on this page.

2. Access control and tenant isolation

Every table holding clinical data is protected by database-enforced Row-Level Security (RLS). Access is scoped to the requesting user's organization and role, so therapists, parents, and clinic staff can only reach records their organization and permissions explicitly allow. Role-based permissions are enforced on the server for every action, sign-in attempts are rate limited, and when a team member is removed or downgraded their active sessions are revoked.

3. Audit trails

Miravio writes audit log entries for authentication events (sign-in success and failure, sign-out, password changes, role changes, member removal) and for access to PHI, including client record views, session note reads, and data exports. Audit entries reference records by internal identifiers rather than names, so the audit trail itself does not duplicate PHI. Clinic administrators can review their organization's audit history from the compliance dashboard.

4. AI features and PHI

Miravio's optional AI executive summaries are disabled by default. When the feature is off, summaries are produced by deterministic templates and no data leaves our infrastructure. The AI prompt path is reviewed so that it carries only organization-level aggregate metrics (counts, totals, and rates), never client records or names, and we will not enable AI processing for any clinic's data until a business associate agreement with the AI provider is in place.

5. Business Associate Agreements

For covered entities such as clinics and healthcare providers, Antitropy LLC (operating as Miravio) acts as a business associate. Our deployment process requires the infrastructure BAA chain to be in place before any PHI enters a production environment: Supabase offers a BAA for exactly this purpose (see the HIPAA projects guide linked above), and we execute a BAA with each clinic before it brings client data onto the platform. To request or review a BAA, contact us at the address below.

6. Your data, guaranteed portable

Families and clinics can export their complete records at any time. Guaranteed portability is a product principle: if you leave Miravio, your data leaves with you in usable formats, and the clinic remains the covered entity for its clinical records throughout.