Grove holds patient information on behalf of private clinics. This page explains, plainly, how we protect it, what we support, and what we will do if something goes wrong.
Grove gives your clinic the tools and safeguards these laws expect. Your clinic remains responsible for its own compliance and for how it uses them.
| Standard | Status | What Grove provides |
|---|---|---|
| HIPAA (United States) | Built to support | Business Associate Agreement accepted at sign-up · encryption · audit logs · role-based access |
| PIPEDA (Canada) | Built to support | Privacy Policy · consent records · data export and deletion on request |
| UK GDPR (United Kingdom) | Built to support | Data processing terms · right of access and erasure · breach notification |
| Australian Privacy Act 1988 (APPs) | Built to support | Privacy Policy · access and correction requests · breach notification |
| PCI DSS | Handled by Stripe | Card details go directly to Stripe, a PCI DSS Level 1 service provider. Grove never stores card numbers. |
| SOC 2 | Not yet audited | Grove has not yet completed an independent SOC 2 audit. It is planned. Our core infrastructure providers maintain their own SOC 2 reports. |
The safeguards behind every Grove account.
Data is encrypted in transit with TLS and at rest with AES-256. Backups are encrypted too.
Every record belongs to one clinic. Database rules make sure a clinic can only ever read and change its own data.
Role-based access for owners, providers and staff. Patients see only their own portal. Every server request is checked against the signed-in user.
Access to patient records is logged, so your clinic can see who viewed or changed what, and when.
Secure sign-in with hashed passwords. Sessions expire and can be revoked. Clinic accounts are created only through sign-up with accepted agreements.
The database is backed up automatically by our infrastructure provider, so data can be restored if something goes wrong.
Grove's database is hosted in Canada on Amazon Web Services (ca-central-1, Montreal), through Supabase. If your clinic has a data-residency requirement, talk to us before you sign up.
The services Grove uses to run the platform, and what each one handles.
| Sub-processor | Purpose | Data handled |
|---|---|---|
| Supabase (AWS) | Database, sign-in, file storage | All clinic and patient data |
| Netlify | Website hosting and server functions | Application code · requests in transit |
| Stripe | Subscriptions and patient payments (Grove Pay) | Billing and card details · no clinical records |
| Twilio | Text message reminders and replies | Phone numbers and message content · uses your clinic's own Twilio account |
| Daily | Telehealth video visits | Live video and audio · not recorded by Grove |
| Anthropic | AI scribe, AI front desk, Grove Intelligence | The text you send to an AI feature · not used to train AI models |
| Resend | Account and notification email | Email addresses and message content |
Our commitments if there is ever a security incident.
We isolate the affected systems, rotate credentials and preserve the evidence needed to understand what happened.
Affected clinics are notified without undue delay, with what we know, what we do not know yet, and what we are doing about it.
We support your clinic in meeting its notification duties, including HIPAA breach notification in the United States, PIPEDA in Canada, the 72-hour UK GDPR window, and the Notifiable Data Breaches scheme in Australia.
After an incident we share a plain summary of the cause and the changes we made so it does not happen again.
What you and your patients can do with the data Grove holds.
Data export is included on every plan. Your data is yours.
You can ask us to delete your account and its data. We confirm when it is done. Some records may be kept where the law requires it.
Patients can ask your clinic for their record. Grove gives you the tools to provide it.
Sell your data. Use patient data to train AI. Share data with advertisers, insurers or employers. See all our promises →
If you believe you have found a vulnerability, please tell us at security@getgrovemd.com. We will acknowledge your report and keep you informed. See our security page.
Request our Business Associate Agreement, data processing terms, or answers to your security questionnaire.
Request documentation →