HIPAA, the Health Insurance Portability and Accountability Act, is a U.S. law designed to ensure the confidentiality and security of Protected Health Information (PHI). It sets standards for electronic healthcare transactions, ensures secure communication between healthcare entities, and establishes regulations for handling and disposing of PHI. To demonstrate compliance, Finch conducts regular risk assessments; implements strict access controls on who can access PHI; encrypts PHI in transit and at rest; maintains detail audit trails of access; trains employees on HIPAA policies and data privacy; develops comprehensive policies related to data privacy, security and breach response; and secures physical locations where PHI is stored.

The CCPA is designed to provide California residents with greater control over their personal information, including rights to access, delete, and opt-out of the sale of their data. Businesses are required to disclose their data collection practices and provide clear notices about how personal information is used and shared, as well as implement measures to safeguard personal information against unauthorized access, use, or disclosure. To demonstrate compliance, Finch keeps an accurate record of all personal information collected; implements systems and procedures for consumers to easily exercise their rights; has a privacy policy reflecting CCPA requirements; adopts robust data security practices including encryption and access controls; trains employees on CCPA requirements; ensures contracts with third-party vendors include data protection provisions; develops and implements procedures for handling consumer requests related to their data; and performs regular audits to assess compliance.

The GDPR is designed to safeguard the personal data of EU residents, ensuring it is collected, processed, and stored securely and responsibly. To comply, Finch provides individuals with rights such as access to their data, data correction, deletion (right to be forgotten), and the ability to restrict or object to processing; follows a unified standard for handling personal data; is transparent about our data processing activities and how personal data is used; and demonstrates compliance with GDPR principles and implement appropriate measures to protect data. To demonstrate compliance, Finch maintains detailed records of data processing activities and data flows within the organization; ensures privacy policies are transparent, accessible, and provide clear information about data processing activities and data subject rights; implements robust mechanisms to obtain, record, and manage consent for data processing; Develops efficient processes for handling requests related to data subject rights; performs DPIAs for high-risk processing activities to identify and address potential risks to data subjects; applies strong security measures, including encryption, access controls, and regular security audits; updates agreements with data processors to ensure they comply with GDPR requirements and include necessary data protection clauses; conducts regular training for employees on GDPR requirements; implements procedures for managing data breaches; and maintains thorough documentation of data processing activities, policies and compliance.

The Data Privacy Framework (DPF) is a set of guidelines and principles designed to ensure the protection and privacy of personal data, particularly in the context of international data transfers. While different frameworks exist, the most prominent are the EU-U.S. Data Privacy Framework (DPF) and the Swiss-U.S. Data Privacy Framework. To demonstrate compliance, Finch has self-certified with the U.S. Department of Commerce, which included completing a detailed application and showing continued adherence to the framework’s principles. Our certification status can be found on the Data Privacy Framework site.

SOC 2 (System and Organization Controls 2) is an auditing framework designed to evaluate an organization’s controls related to information security, availability, processing integrity, confidentiality, and privacy. It is commonly used by service organizations to demonstrate their commitment to maintaining robust data protection and operational controls. To demonstrate compliance, Finch implements best practices in information security; monitoring and reporting; processing integrity; confidentiality in data encryption and data handling procedures; privacy; documenting and training employees on internal policies; and monitoring and auditing. Adherence is evaluated annually by a certified third party, and the report is available under NDA.

The AWS resources that process Finch data are located within the US-West-2 region (Oregon, USA) and the associated data centers