Trust Center
Transparency for clinicians, practice owners, and institutional buyers. This page summarises how Hanah handles health information, which subprocessors are in scope for NZ production, and how each security control relates to the Privacy Act 2020 (Information Privacy Principles) and the Health Information Privacy Code 2020 (HIPC) where health information is involved. Status markers are a temporary editorial aid and will be removed once every item is production-verified.
Who this is for: Clinics, health networks, privacy officers, and IT security teams doing due diligence on Hanah. At a glance: for New Zealand deployments, patient health information at rest is hosted in New Zealand (Catalyst Cloud). Speech and LLM inference use Microsoft Azure and Google Cloud Vertex in Sydney, Australia, under enterprise terms that prohibit training on your content. Deeper evidence sits in our Security & Operations Handbook; the Controls tab cites how each line aligns with the Privacy Act 2020 (IPPs) and HIPC 2020.
Validation methodology
How we measure transcription accuracy and documentation hallucination — one harness, one corpus, two evaluation layers (WER + LLM jury). The rules every published number is graded by.
Read the methodology →Validation transparency
Per-recording transcripts, generated documents, and per-LLM juror verdicts against an authoritative ground-truth corpus. The full data, not just headline numbers.
View report →Each row is a control in the usual ISO sense: policy (governance and documented procedure), technical (enforced by systems and configuration), or vendor (contractual and subprocessor assurance). Tags show the dominant evidence type; many rows combine more than one. Detail traces to our internal Security & Operations Handbook. The line under each row cites how that control supports named items in New Zealand privacy law — indicative only, not a substitute for legal advice.
Authorities: Privacy Act 2020 (Information Privacy Principles, Schedule 1) and the Health Information Privacy Code 2020 (HIPC), issued under that Act.
Infrastructure & platform
Infrastructure security
Defines where Hanah runs for the NZ region, how production is segmented from operations, and how encryption protects customer data between clinicians, our stack, and AI subprocessors. These are mostly technical controls with administrative backing in the Security & Operations Handbook.
-
✅
Technical PolicyNZ-hosted production workloads
Primary application servers, databases, object storage, and backups for the NZ deployment are located in New Zealand (Catalyst Cloud). Administrative records describe regions and change approval; technical deployment pins resources to the NZ project.
NZ privacy alignment: Privacy Act 2020 — IPP 5 (storage and security), IPP 13 (disclosure outside New Zealand — keeping health information in NZ reduces offshore exposure); HIPC 2020 — Rule 5 (storage and security).
-
✅
TechnicalEncryption in transit
Public ingress uses modern TLS. Traffic to Microsoft Azure Speech and Google Vertex uses TLS to Sydney regions only as configured. This is a technical control verified in architecture reviews and deployment config.
NZ privacy alignment: Privacy Act 2020 — IPP 5 (reasonable security safeguards); HIPC 2020 — Rule 5.
-
✅
Technical PolicyEncryption at rest
Databases, object storage, and backup objects use NZISM-aligned algorithms (e.g. AES-256-GCM) with keys managed per our cryptography policy. WAL-G backups add client-side encryption before off-site storage.
NZ privacy alignment: Privacy Act 2020 — IPP 5; HIPC 2020 — Rule 5.
-
✅
Technical VendorEdge DDoS protection and WAF
A managed edge layer fronts public hostnames, absorbing volumetric attacks and applying WAF rules for common web abuse. Provider-level protections and tight firewall posture remain in place behind the edge.
NZ privacy alignment: Privacy Act 2020 — IPP 5; HIPC 2020 — Rule 5.
-
✅
Technical PolicyIntrusion detection
Layered detection: the Catalyst platform provides network-layer IDS, while each VM runs fail2ban (SSH brute-force prevention), UFW with default-deny posture, and unattended security upgrades. Authentication and access events from the auth-proxy are shipped to a central Loki/Grafana stack so anomalous login patterns surface in dashboards and alerts. Policies assign triage ownership when alerts fire. Kernel-level runtime IDS for containers is a planned enhancement on top of this baseline.
NZ privacy alignment: Privacy Act 2020 — IPP 5; HIPC 2020 — Rule 5. Supports timely detection and assessment where a serious privacy breach may have occurred.
Product & application
Product security
How users authenticate, how authorisation is enforced in the product and API layer, and how we build and ship software. Mixes technical enforcement (JWT, RBAC) with administrative SDLC and review requirements.
-
✅
Technical VendorAuthentication and sessions
Clinicians authenticate through Firebase (OIDC/OAuth-style flows); every API path validates identity. Session lifetime and lockout behaviour align with our access-control policy.
NZ privacy alignment: Privacy Act 2020 — IPP 5, IPP 12 (unique identifiers); HIPC 2020 — Rules 5 and 12 (as they apply to health information identifiers).
-
✅
Technical PolicyRole-based access control
Clinician, patient, and admin capabilities are separated in the data model and GraphQL layer so least-privilege is the default. Role definitions and review cadence are documented administratively.
NZ privacy alignment: Privacy Act 2020 — IPP 5, IPP 10 (use), IPP 11 (disclosure); HIPC 2020 — Rules 5, 10, 11.
-
✅
Technical PolicyMandatory MFA for privileged paths
Mandatory MFA is enforced for accounts that can change security-sensitive settings or access high-risk data, via Firebase Authentication.
NZ privacy alignment: Privacy Act 2020 — IPP 5; HIPC 2020 — Rule 5.
-
✅
Technical PolicySecure development lifecycle
Changes flow through source control, review, and pinned dependencies. Security impact is considered for substantive features as an administrative gate; technical tools (Dependabot, etc.) support ongoing hygiene.
NZ privacy alignment: Privacy Act 2020 — IPP 5 (reasonable steps to protect information through the information life cycle); HIPC 2020 — Rule 5.
-
✅
Technical PolicySoftware bill of materials (SBOM)
Each release carries a machine-readable inventory of dependencies for vulnerability response. SBOM export is wired into CI as part of our supply-chain assurance programme.
NZ privacy alignment: Privacy Act 2020 — IPP 5; HIPC 2020 — Rule 5.
Data & privacy
Data & privacy
Retention, deletion, subject rights, and visibility into security-relevant events. These controls pair automated enforcement in the product and database with administrative procedures (DSAR handling, breach notification, quarterly reporting).
-
✅
Technical PolicyRetention and deletion for ambient artefacts
Audio and transcript material defaults to a short retention window with automated deletion; clinical notes follow each organisation’s retention policy. Once integrated with your record system, the authoritative clinical record remains yours.
NZ privacy alignment: Privacy Act 2020 — IPP 9 (retention); HIPC 2020 — Rule 9 (retention of health information).
-
✅
Technical PolicyTamper-evident deletion log and quarterly reports
Retention-driven deletions are recorded in
deletion_log, an append-only Postgres table with noUPDATEorDELETEgrants to any role. Each row links to the previous one by SHA-256 hash chain (row_hash = sha256(prev_hash ‖ canonical(metadata))), so altering or removing any earlier row breaks every subsequent hash and is detected by the in-database verifierhanah_verify_deletion_chain(). Companion audit tables (ai_audit,secret_access_audit) are also append-only. Quarterly customer-facing rollups are produced byhanah_deletion_report_quarter(year, quarter).NZ privacy alignment: Privacy Act 2020 — IPP 9, IPP 5 (integrity of safeguards); HIPC 2020 — Rules 9 and 5.
-
✅
Policy TechnicalData subject access and correction
Individuals can request access or correction under the Privacy Act 2020; Hanah documents timelines, formats (JSON + human-readable exports), and escalation paths. Tooling supports export where data lives in Hanah systems.
NZ privacy alignment: Privacy Act 2020 — IPP 6 (access), IPP 7 (correction); HIPC 2020 — equivalent access and correction rules for health information.
-
🔧
Technical PolicyUnified audit visibility
Security-relevant events (authentication, privilege use, configuration changes) are queryable for institutional customers and forwardable to your SIEM (for example Microsoft Sentinel) where contractually agreed. Configured per customer.
NZ privacy alignment: Privacy Act 2020 — IPP 5; supports compliance with notifiable privacy breach provisions where a serious breach is suspected.
AI & clinical safety
AI security & compliance
Controls specific to ambient AI: no secondary use of health data for training, human oversight before clinical reliance, measurement of quality (WER), and abuse-resistant prompting. Combines contractual third-party controls with product workflow and clinical governance.
-
✅
Vendor Policy TechnicalNo secondary use for model training
Microsoft and Google enterprise agreements prohibit training on customer content; Hanah does not operate an internal training pipeline on your health data. Administrative vendor reviews and technical configuration (region-locked endpoints) support the claim.
NZ privacy alignment: Privacy Act 2020 — IPP 10 (use), IPP 11 (disclosure); HIPC 2020 — Rules 10 and 11 (permitted use and disclosure of health information).
-
✅
Policy TechnicalHuman-in-the-loop before clinical reliance
Generated notes require explicit clinician review and finalisation before they are treated as part of the clinical record. This is both a product control (workflow gates) and a policy commitment in the PIA.
NZ privacy alignment: Privacy Act 2020 — IPP 8 (accuracy before use), IPP 10 (use for purpose); HIPC 2020 — Rule 10 (clinical and permitted uses).
-
✅
Policy TechnicalWER methodology and published cohort results
One harness, two evaluation layers, run on every grading pass: Word Error Rate against verbatim ground-truth transcripts (Layer A), and an LLM jury panel measuring both coverage (does the note capture each pre-registered expectation?) and hallucination (does the note contain claims the transcript does not support — i.e. content the model invented?). The full methodology is published, and live results render directly from the harness's aggregate output. The corpus continues to graduate v1 (synthetic) → v2 (role-play) → v3 (real consent-based) → v4 (joint with HNZ).
NZ privacy alignment: Privacy Act 2020 — IPP 8 (accuracy); HIPC 2020 — Rule 5 and clinical-quality expectations tied to safe use of health information.
-
✅
Technical PolicyPrompt injection and unsafe-output monitoring
System prompts are server-controlled and inputs are bounded by the clinical workflow (no free-form chat surface). Vertex and Azure safety classifiers run on every generation; when they trigger, the stream surfaces a content-filter finish reason that is captured in the per-call
ai_auditrow alongside a canonicalai.content_policyerror code, latency, tokens, and a Tempo trace ID. Anomalous patterns surface in dashboards over that audit table. Cross-call behavioural anomaly detection for abuse patterns is a planned enhancement on top of this baseline.NZ privacy alignment: Privacy Act 2020 — IPP 5, IPP 10; HIPC 2020 — Rules 5 and 10 (guarding integrity of processing and permitted use).
-
✅
Technical PolicyMulti-party consent capture in product
When the clinician clicks record, the product opens a consent dialog requiring explicit confirmation that consent has been obtained from the patient and any other participants in the session. Recording cannot begin until that check is acknowledged, and the confirmation is bound to the encounter alongside clinic policy referenced in the privacy impact assessment.
NZ privacy alignment: Privacy Act 2020 — IPP 3 (collection awareness), IPP 4 (manner of collection); HIPC 2020 — Rule 3 (collection with awareness for health information).
Organisation & third parties
Organisational security
How Hanah the company governs security: accountability, policies, independent assurance, and integration with customer security tooling. These are primarily administrative controls; some have technical deliverables (e.g. SIEM connectors).
-
✅
PolicySecurity governance and risk register
A named executive is accountable for information security; risks are logged with owners and target dates and reviewed on a fixed cadence. This matches what buyers typically expect from an ISO-style management system, even at our current scale.
NZ privacy alignment: Privacy Act 2020 — IPP 5 (agency accountability for reasonable safeguards); HIPC 2020 — Rule 5.
-
✅
PolicyBoard-approved policy pack
Formal policies cover access, cryptography, incident response, vendors, and change management. The pack is board-approved and held under version control; full content is available under NDA.
NZ privacy alignment: Privacy Act 2020 — IPP 5; HIPC 2020 — Rule 5.
-
🔧
Policy TechnicalCustomer SIEM forwarding (e.g. Sentinel)
Security events from Hanah-controlled systems are forwarded into your Sentinel workspace (or equivalent) for joint monitoring where contractually agreed. Configured per institutional customer.
NZ privacy alignment: Privacy Act 2020 — IPP 5; supports detection and response where notifiable privacy breaches may arise.
Subprocessors listed here are those that may process or store Hanah customer data in our New Zealand production architecture. Regions reflect how we configure services for health workloads. Clinician sign-in may use global identity infrastructure where no patient health information is stored — see the Firebase row and our privacy analysis for the carve-out.
| Subprocessor | Purpose | Data categories | Region | Notes |
|---|
Vertex AI / Gemini — models in use
The rows below are pulled live from Hanah’s public /api/trust registry (same contract as audits). Only entries with vendor Google and deployment Vertex are shown here — i.e. LLM inference routed through Google Cloud Vertex AI in the region configured for NZ, not the consumer Gemini API or Google STT.
Loading model list…
If this fails to load (network or ad blocker), open the raw JSON: — region is set via data-trust-region on the <body> element.
Operational transparency: a public status page (uptime and incidents) sits alongside the production /healthz readiness endpoint used by our own monitoring.
PhysiPal Pty Ltd (trading as Hanah) — New Zealand. This Trust Center is a high-level summary. Contractual commitments, data processing terms, and subprocessors in force at signing supersede this page. Status emoji markers (✅ 🔧) are temporary and will be removed after independent verification of each row.