GuardianHeart
Privacy & Security Policy
Privacy & Security Policy
Effective: May 2026 · Jurisdiction: Arizona + Federal HIPAA
Guardian Heart LLC · Phoenix, Arizona
§ 1 — Data Sovereignty
GuardianHeart operates on a local-first, sovereign architecture. All Protected Health Information (PHI) is processed and stored within the facility's own network. No PHI is transmitted to external servers without explicit, documented authorization from the covered entity. Our Edge Node deployment ensures 100% data residency compliance.
§ 2 — What We Collect
- De-identified clinical telemetry (12-factor TRM data) for care optimization
- Encrypted medication administration records (PHI, stored locally)
- Caregiver interaction logs (anonymized SHA-256 hash identifiers)
- Audit chain events (Merkle-hashed, immutable, 6-year retention)
§ 3 — Technical Safeguards
- AES-256 encryption at rest, TLS 1.3 in transit
- SHA-256 Merkle-chained audit trail — tamper-evident and retroactively verifiable
- Dynamic Poly-Encryption (DPE) for PHI at the field level
- Zero-trust access controls with role-based permissions
- Break-glass emergency access with mandatory justification and audit logging
§ 4 — HIPAA Compliance
GuardianHeart is designed as a HIPAA-compliant Business Associate. We execute Business Associate Agreements (BAAs) with all covered entities. Our platform is built to satisfy the 2026 HIPAA Security Rule updates and Arizona R9-10 requirements including 6-year audit record retention.
§ 5 — Contact
Data Privacy Officer: contact@guardianheart.care
Guardian Heart LLC · Phoenix, Arizona
Home ·
About Us ·
Platform