Trust Center

BentoBox is fully HIPAA-compliant with signed Business Associate Agreements (BAAs) with all our vendors. We have implemented HIPAA-required safeguards and maintain our compliance program using Vanta. Your Protected Health Information (PHI) is legally protected. We implement administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of your health information.

Health records, medications, appointments, vitals, provider information, and AI conversations, all entered by you. We only store data that you explicitly provide to manage your health. We do not access external health systems unless you explicitly connect them.

Passwords (managed by our authentication provider), payment card numbers (managed by our payment processor), browsing history, location data, contacts, or any other data from your phone. We never sell or rent your identifiable data, at any time. De-identified data (stripped of everything that could identify you) may be shared with researchers, and only with your explicit opt-in consent.

All data is encrypted with AES-256 at rest and protected by TLS 1.2 or higher in transit. Row-level security in the database ensures your data is fully isolated from other users. All access to health data is logged and auditable.

AI conversations are used only to assist you and are never used to train AI models. Your identifiable data is never sold, and your data is never shared with advertisers. We maintain a Business Associate Agreement (BAA) with our AI provider that enforces Zero Data Retention (ZDR): your prompts and health information are not stored or logged by the AI provider once your request has been answered.

You can request a full export or deletion of your data at any time by contacting support. Your health data belongs to you.