Compliance position

TAALO is not HIPAA-certified, SOC 2-attested, ISO 27001-certified, or a registered medical device. We do not claim clinical accuracy for camera-based measurements or movement observation — they are prototype aids to a professional's own judgement. TAALO does not diagnose, treat or prescribe.

• Credential verification before any real client record can be opened
• Two-step sign-in requirement for access to real client data
• Per-record access rules enforced in the database
• Explicit, versioned client consent before any record is shared
• Private file storage with per-request authorisation
• Append-only audit trail of verification, invitation and consent events
• Encryption in transit, and at rest by our hosting and database providers

TAALO is designed for fitness and wellness professionals, who are usually not covered entities. We therefore do not currently sign Business Associate Agreements and you should not use TAALO to store protected health information under HIPAA.

Work already done that would support a future HIPAA posture: minimum-necessary access, unique user identification, automatic session termination, audit controls, and encryption in transit and at rest. Work still outstanding: a formal risk analysis, written policies and workforce training, a documented breach notification procedure, and BAAs with each subprocessor. We will not describe TAALO as HIPAA-ready until all of that is complete and independently reviewed.

No SOC 2 audit has been performed and no report exists. Controls mapped to the Security criterion that already operate: logical access control, authentication and two-step verification, change management through reviewed migrations, audit logging, and encryption. Outstanding before an audit could begin: documented policies, vendor management records, formal incident response with tested runbooks, and a continuous monitoring period of at least three months.

For records a professional creates about their clients, the professional is the data controller and TAALO is the processor. Individuals can request access, correction, export or deletion of their data by writing to privacy@taalo.app; we respond within 30 days. Retention and deletion timelines are set out in our privacy notice.

We use the following categories of service provider. We will publish named providers, and give notice of changes, before TAALO leaves early access.

• Application hosting and content delivery — Serves the website and application
• Managed database, authentication and file storage — Stores accounts, records and uploads
• Payment provider — Processes card payments and subscriptions
• Transactional email provider — Sends sign-in, invitation and account emails
• AI model provider — Generates draft observations and plan suggestions for professional review

If we become aware of unauthorised access to personal data, we investigate immediately, contain the issue, and notify affected professionals and, where required, the relevant supervisory authority within 72 hours of becoming aware. Affected individuals are told what happened, what data was involved, and what to do next.