Cernia Health, Inc. (“Cernia”, “we”, “us”) operates the Cernia FHIR platform (“Platform”). This Privacy Policy describes how we collect, use, and protect information when you use the Platform or visit this trust center.
Template notice: This is a privacy policy template provided for illustrative purposes. Customers and operators should replace this with a policy drafted or reviewed by legal counsel for their specific jurisdiction and use case.
1. Information we collect
We collect information in two contexts:
Platform customers (healthcare organisations and developers): We collect account information (name, email, organisation), usage telemetry (API call counts, error rates), and support communications. We do not access PHI stored in your FHIR resources unless you grant explicit support access.
End users of customer deployments: Cernia acts as a data processor on behalf of our customers (data controllers). Patient data, clinical records, and other PHI processed through the Platform are governed by the customer's privacy practices and any applicable Business Associate Agreement.
2. HIPAA and Protected Health Information
Cernia enters into Business Associate Agreements (BAAs) with customers who process Protected Health Information (PHI) under HIPAA. As a Business Associate, we:
- Implement and maintain safeguards required under the HIPAA Security Rule (45 CFR §164.306).
- Do not use or disclose PHI except as permitted under the BAA and applicable law.
- Report breaches of unsecured PHI to covered entity customers as required by the HIPAA Breach Notification Rule.
To request a BAA, contact: legal@cerniahealth.com
3. 42 CFR Part 2 — Substance Use Disorder Records
For customers who process substance use disorder (SUD) treatment records, Cernia supports the consent gating mechanisms required under 42 CFR Part 2. Our platform implements FHIR Consent resources with SUD-specific disclosure gating that prevents sharing Part 2-protected records without explicit patient consent.
4. Data retention
Audit logs are retained for 90 days by default and up to 7 years for customers with extended retention policies configured in TenantPolicy. Customer FHIR resources are retained for the duration of the subscription and for 30 days after cancellation, after which they are permanently deleted. Customers may configure shorter retention periods or request immediate deletion via support.
5. Data subject rights (GDPR)
For customers subject to the General Data Protection Regulation (GDPR), we support data subject rights including:
- Right of access — customers may export all data via the FHIR $everything operation.
- Right to erasure — PHI erasure is subject to HIPAA minimum-necessary and audit-retention requirements. We implement a `right-to-erasure-with-audit-carveout` pattern described in ADR-0016.
- Data portability — all data is exportable in FHIR R4 JSON format.
6. Security
We implement technical and organisational security measures to protect your data. See our Security page for details of our security architecture and Compliance page for our certification status.
7. Contact
For privacy questions or data subject requests: privacy@cerniahealth.com
For security concerns: security@cerniahealth.com (see also our Responsible Disclosure Policy)
Cernia Health, Inc.
Privacy Team
privacy@cerniahealth.com