Every layer of your health. Owned by you. Controlled by you.

Yes. HealthKey Labs completed a SOC 2 Type 1 examination of the Arxova platform, performed by Percilchofe CPA LLC, with a report date of September 23, 2026. A SOC 2 Type 1 report evaluates whether controls are suitably designed at a point in time. The full report is available under NDA — request it at privacy@arxova.health.

Arxova is built to align with HIPAA and GDPR, and has completed a SOC 2 Type 1 examination. There is no such thing as HIPAA certification — no government body certifies apps — so we describe our posture as HIPAA-aligned. We maintain Business Associate Agreements with our core providers that host or process health information on our behalf, including our hosting and database provider, cloud storage provider, AI provider, and business email and collaboration provider. Other subprocessors are covered by data processing agreements where offered. The Subprocessors tab describes what data each one receives.

Structured health data is held in encrypted databases hosted on cloud infrastructure in the United States. Certain records a user chooses to store permanently are encrypted before they are uploaded to Arweave, so the network holds only encrypted data. Uploads made before October 1, 2026 also carry public labels: a wallet address and a general record category. Arxova writes tamper-evident audit receipts to the Solana blockchain for events such as granting or revoking access. Medical record contents and individual health measurements are never written to the blockchain. Since October 1, 2026, receipts use a random reference and a generic event name. Receipts written before then show the account's wallet address and the type of event, such as device sync or health alert. On-chain receipts are permanent.

All connections are encrypted in transit, and every Arxova database is stored on encrypted disk volumes. On top of that, the most sensitive data receives application-level AES-256-GCM encryption: records from health-record connections and their copies in permanent storage, genomic files, raw device data, connection tokens, consent signatures, and ARIA conversations and memory. Data that features such as scores, charts and ARIA must read, like daily wearable totals and medication lists, is protected by disk encryption only. Arxova holds the keys for most records so those features can work, in a secrets system separate from the databases. Records encrypted with a key derived from a user's wallet require that key or an authorized decryption path. Every time our servers decrypt health data, we log what did it, the reason and how many records were involved. The log never contains the health data itself.

Medical records the user chooses to connect, plus labs, medications, and wearable readings they add or sync. Structured clinical values are stored keyed to a pseudonymous identifier rather than to the user's name; this limits exposure but is not anonymization, since Arxova holds the mapping. Arxova does not sell health data and is not a data broker.

No. The Arxova app contains no advertising SDK, no attribution SDK, and no tracking pixel, and we do not run ad attribution against app installs. Both the app and the website use one product analytics tool, PostHog, to understand which features are used and where the product is slow or confusing. On the website it loads only after a visitor grants consent, and never on the pages the app opens in its own window. In the app it records which sections and features were used, along with timings, counts, and outcomes. Names, email addresses, and wallet addresses are never sent to it, and the content of ARIA conversations is never sent to it — only how long a question was and whether the response succeeded.

Yes. A deletion request is confirmed and completed within 30 days, and we ask our processors to delete the data they hold for the account. One exception is disclosed up front: encrypted files a user chose to store on Arweave cannot be removed from that network, because Arweave is permanent by design. When an account is deleted, we remove the encryption keys we hold from active systems, and copies of those keys in our database backups expire within 5 days. After that, Arxova can no longer decrypt those files. This does not erase plaintext or keys someone previously obtained. This is disclosed in the app before that storage is used, and in our Privacy Policy.

See the Subprocessors tab. We maintain Business Associate Agreements with our core providers that host or process health information on our behalf, including our hosting and database provider, cloud storage provider, AI provider, and business email and collaboration provider. Other subprocessors are covered by data processing agreements where offered. The Subprocessors tab describes what data each one receives.

In the event of a breach affecting personal or health information, we notify affected users in accordance with HIPAA's Breach Notification Rule and other applicable law.

Report it to privacy@arxova.health. We operate a responsible disclosure program and do not pursue legal action against researchers acting in good faith.