Trust Center — Hormonaly

One clear answer on PHI, HIPAA, and data retention. Standard plans require no PHI — queries process without patient identifiers. PHI is supported only on enterprise deployments covered by a BAA, on HIPAA, SOC 2, and HITRUST-certified infrastructure operated with our clinical partner Canvas Medical. Covers intended and prohibited use, per-plan PHI policy, retention, security posture, model governance, incident response, and content corrections.