How we protect information

• Arweave — Encrypted Record Storage

  Arxova uses the Arweave network for permanent storage of encrypted health records. Records are encrypted before upload, and their encrypted contents are not publicly readable without the necessary decryption keys. However, encrypted records and associated transaction metadata may remain permanently accessible on the network. Historical uploads may contain wallet-linked metadata.

• Data Encryption

  All connections are encrypted in transit, and every database is stored on encrypted disk volumes. The most sensitive data, including records from health-record connections, genomic files, raw device data, consent signatures and ARIA conversations, also receives its own AES-256-GCM encryption, with keys held in a secrets system separate from the databases.

• Data Retention & Deletion

  Deletion requests are processed within 30 days, subject to applicable legal retention requirements. Arxova deletes personal information from systems under its control and instructs applicable service providers to delete information as required. Encrypted records previously uploaded to Arweave cannot be removed from the decentralized network. When an account is deleted, Arxova deletes the encryption keys under its control according to its key-retention procedures, preventing further decryption through Arxova. Previously exported records, independently retained keys, and blockchain transaction metadata may remain accessible.

• Decentralized Network Disclosure

  Arweave and Solana are public decentralized networks, not conventional third-party subprocessors operating under data processing agreements with Arxova. Infrastructure providers used to interact with these networks are disclosed separately in our Subprocessor Register.

• Employee Security Training

  Security awareness training is required for all personnel with access to production systems.

• Incident Response

  Documented incident response procedures. In the event of a breach affecting personal or health information, affected users are notified in accordance with HIPAA's Breach Notification Rule and other applicable law.

• Logging & Monitoring

  Access to health data is audit logged. Application and infrastructure logs are centrally collected and reviewed.

• Physical Security

  Arxova does not operate its own data centers. Infrastructure runs on cloud providers whose facilities undergo independent SOC 2 examinations and maintain physical access controls, surveillance, and environmental controls.

• Solana — Tamper-Evident Audit Records

  Arxova uses the Solana blockchain to record tamper-evident audit transactions. Medical records and health measurements are not intentionally published to Solana. Blockchain transactions are publicly visible and permanent. Historical transactions may contain wallet addresses and event descriptions associated with health-related activities.

• Vendor Management

  Third-party service providers are evaluated for security, privacy, and applicable regulatory requirements before onboarding. Subprocessors are documented in our public register and governed by applicable contractual safeguards, including Data Processing Agreements and Business Associate Agreements where required.

Found a vulnerability? Report it to our security team or email privacy@arxova.health.