HIPAA
Built for patient data.
Perfect Photo handles before-and-after photos that are protected health information. Here is exactly how we protect them — a signed BAA, encrypted connections, private storage, audit logging, and a BAA your practice signs before the first photo is uploaded.
Signed BAA with our infrastructure
A Business Associate Agreement is signed with DigitalOcean, covering the servers, storage, and backups that hold patient data.
Patient photos stay private
Photos are stored in private storage and served only through short-lived links that expire — never on a public URL.
You control what's shared
Each patient's photo-use authorization is recorded and enforced at every publish path. Nothing goes public without it.
How we protect patient data
The controls, plainly.
Encrypted in transit (TLS 1.2+)
Every connection to Perfect Photo uses TLS 1.2 or 1.3. Older, broken protocols are disabled.
Database encrypted in transit, strictly verified
The app's connection to the database is encrypted, and the database's certificate is verified on every connection — not just opportunistically encrypted.
Encrypted data volume for the database
The database keeps its data on an encrypted block volume.
Audit logging of every PHI access
Every access to patient data is written to an audit log — who looked at what, and when.
Role-based access controls
Access is scoped by role and re-checked on every request, so a practice only ever sees its own data.
Nightly encrypted backups, restore-tested
The database is backed up nightly to a separate, private, BAA-covered store, and restores are tested.
Business Associate Agreement
A BAA, signed two ways.
With our infrastructure provider
Athrobin Ventures, LLC (Perfect Photo) has a signed Business Associate Agreement with DigitalOcean that covers the Droplets, block storage, object storage, and backups holding patient data. The account is designated HIPAA-eligible by DigitalOcean.
With your practice
Your practice signs a BAA with us at sign-up — a quick click-through e-signature. It’s not optional paperwork: patient photo upload is gated until both the BAA and the service agreement are signed.