HIPAA Compliance & Data Storage

HIPAA applies to covered entities (hospitals, doctors, health plans, insurers) and their business associates (anyone who handles PHI on their behalf). A standalone consumer wellness app that doesn't integrate with healthcare providers is technically NOT a covered entity.

When HIPAA kicks in:

• ⚠ You partner with a clinic, doctor's office, or hospital that sends patients to your app
• ⚠ An employer uses your scanner for employee wellness programs
• ⚠ An insurance company integrates your scan data into their risk assessment
• ⚠ A practitioner uses your platform to track patient health over time

Phone (Client-Side Only)
┌─────────────────────────────────────────────┐
│                                             │
│  Camera/Sensors                             │
│       │                                     │
│       ▼                                     │
│  MediaPipe / ONNX / Web Audio               │
│       │                                     │
│       ▼                                     │
│  346 Marker Results (processed locally)     │
│       │                                     │
│       ├──▶ IndexedDB (encrypted)            │
│       │    └─ AES-256 with user passphrase  │
│       │                                     │
│       ├──▶ Export to PDF (user-initiated)    │
│       │                                     │
│       └──▶ Export to JSON (for backup)      │
│                                             │
│  YOUR SERVERS NEVER SEE THIS DATA            │
└─────────────────────────────────────────────┘

Implementation Details

Client-Side Encryption Code Pattern

// Derive encryption key from user's passphrase
async function deriveKey(passphrase: string): Promise<CryptoKey> {
  const enc = new TextEncoder();
  const keyMaterial = await crypto.subtle.importKey(
    'raw', enc.encode(passphrase), 'PBKDF2', false, ['deriveKey']
  );
  return crypto.subtle.deriveKey(
    { name: 'PBKDF2', salt: enc.encode('vhscanner-salt'), iterations: 100000, hash: 'SHA-256' },
    keyMaterial, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']
  );
}

// Encrypt scan results before storing
async function encryptResults(data: object, key: CryptoKey): Promise<{iv: Uint8Array, data: ArrayBuffer}> {
  const iv = crypto.getRandomValues(new Uint8Array(12));
  const encrypted = await crypto.subtle.encrypt(
    { name: 'AES-GCM', iv }, key, new TextEncoder().encode(JSON.stringify(data))
  );
  return { iv, data: encrypted };
}

// Store in IndexedDB
async function saveScan(scanResults: MarkerResult[], passphrase: string) {
  const key = await deriveKey(passphrase);
  const { iv, data } = await encryptResults(scanResults, key);
  // Store iv + data in IndexedDB — even if someone accesses the DB, they can't read it
}

Phone (Client-Side)
┌─────────────────────────────────────────┐
│  Camera → Processing → 346 Markers      │
│       │                                 │
│       ▼                                 │
│  ENCRYPT with user's key BEFORE sending  │
└───────┬─────────────────────────────────┘
        │ HTTPS (TLS 1.3)
        ▼
Supabase (Pro Plan + BAA signed)
┌─────────────────────────────────────────┐
│                                         │
│  Auth: Supabase Auth (email/OAuth)      │
│  RLS: user can ONLY read own rows       │
│                                         │
│  Table: scans                          │
│   - id (uuid, PK)                       │
│   - user_id (FK → auth.users)           │
│   - scan_date (timestamptz)             │
│   - scan_types (text[])                 │
│   - encrypted_results (bytea) ← AES    │
│   - iv (bytea)                          │
│   - result_hash (text) ← integrity     │
│   - created_at (timestamptz)            │
│                                         │
│  Table: scan_access_log  (audit trail)  │
│   - id, user_id, action, ip,           │
│     user_agent, accessed_at             │
│                                         │
│  NO raw images                          │
│  NO video frames                        │
│  NO PII in marker values                │
│                                         │
│  Encryption at rest: AES-256 (default)  │
│  Backups: encrypted + geo-redundant     │
└─────────────────────────────────────────┘

Supabase Schema

-- Scan results table
CREATE TABLE scans (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  user_id UUID REFERENCES auth.users(id) ON DELETE CASCADE NOT NULL,
  scan_date TIMESTAMPTZ NOT NULL DEFAULT now(),
  scan_types TEXT[] NOT NULL,
  encrypted_results BYTEA NOT NULL,
  iv BYTEA NOT NULL,
  result_hash TEXT NOT NULL,
  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
);

-- RLS: users can only see their own scans
ALTER TABLE scans ENABLE ROW LEVEL SECURITY;
CREATE POLICY "Users read own scans" ON scans
  FOR SELECT USING (auth.uid() = user_id);
CREATE POLICY "Users insert own scans" ON scans
  FOR INSERT WITH CHECK (auth.uid() = user_id);
CREATE POLICY "Users delete own scans" ON scans
  FOR DELETE USING (auth.uid() = user_id);

-- Audit log (append-only, no delete)
CREATE TABLE scan_access_log (
  id BIGSERIAL PRIMARY KEY,
  user_id UUID REFERENCES auth.users(id),
  action TEXT NOT NULL,
  scan_id UUID REFERENCES scans(id),
  ip_address INET,
  user_agent TEXT,
  accessed_at TIMESTAMPTZ NOT NULL DEFAULT now()
);

-- Index for fast user lookups
CREATE INDEX idx_scans_user ON scans(user_id, scan_date DESC);
CREATE INDEX idx_audit_user ON scan_access_log(user_id, accessed_at DESC);

Option A Checklist (Client-Side MVP)

• ☐ Process all scan data in-browser (Web Worker / OffscreenCanvas)
• ☐ Store marker results in IndexedDB with Web Crypto AES-256-GCM encryption
• ☐ Never send health data to any server
• ☐ Add "Export to PDF" for user-initiated sharing
• ☐ Add "Delete All My Data" button that clears IndexedDB
• ☐ Privacy policy stating "your health data never leaves your device"
• ☐ No analytics on health data (analytics only on app usage, not scan results)
• ☐ Discard all camera/audio/photo data after processing (no temp files)

Option B Checklist (Server-Side, add when needed)

• ☐ Sign BAA with Supabase (upgrade to Pro, request BAA via dashboard)
• ☐ Create scans table with encrypted_results (bytea) column
• ☐ Enable RLS on scans table — user can only access own rows
• ☐ Encrypt marker values client-side BEFORE sending to Supabase
• ☐ Create scan_access_log audit table (append-only)
• ☐ Log every read/write to scans with user_id, IP, timestamp
• ☐ Set 6-year retention on audit logs
• ☐ Add "Delete My Account" that cascading deletes all scans
• ☐ Write incident response plan (breach notification within 60 days)
• ☐ Annual risk assessment document
• ☐ Privacy policy updated with data collection, storage, and sharing details
• ☐ Terms of service updated with HIPAA notice