Security and privacy
Your caregivers’ information stays protected.
Encrypted records. Access limited to authorized users. VitalCheck’s security controls underwent an independent SOC 2 Type II examination.
SOC 2 Type II · Security
Independent examination by A-LIGN Assurance
SOC 2 examination details
- Examined entity
- VitalCheck Wellness, Inc.
- Independent auditor
- A-LIGN Assurance
- Category examined
- Security (Trust Services)
- Examination period
- November 15, 2025 – March 15, 2026
- Auditor conclusion
- Controls suitably designed and operating effectively; no exceptions in the reported control tests.
The SOC 2 report is restricted-use. Agencies evaluating ClearToStart can request the security documentation.
How the systems are protected
Security controls behind the service
Encryption
Within the examined systems, VitalCheck encrypts data in storage and in transit.
Access control
Authorized users can access only the systems and information their work requires.
Logging and monitoring
VitalCheck logs activity, monitors production systems and automatically flags suspicious activity.
Vulnerability management
VitalCheck conducts annual vulnerability scanning and independent third-party penetration testing. During the examination period, those tests identified no critical or high-risk vulnerabilities.
Incident response
VitalCheck has procedures to identify security events, escalate them and respond.
Business continuity
VitalCheck maintains and tests business-continuity and disaster-recovery plans.
Vendor oversight
VitalCheck checks service providers before hiring them and reviews critical vendors’ compliance evidence at least annually.
HIPAA
ClearToStart handles caregiver health information under HIPAA. VitalCheck runs the platform and the systems behind it. Licensed physicians make the clinical decisions. Where that relationship applies, VitalCheck acts as a business associate.
Caregivers authorize the records request.
Why do you need the caregiver’s permission?
Your caregiver gives permission for us to request TB records and share the completed certificate with your agency.
Authorization details
California caregivers also sign an authorization section under the Confidentiality of Medical Information Act (Civil Code section 56.11).
The authorization covers this screening only and has an expiration date. The caregiver can withdraw it in writing at any time.
Your agency receives: the signed TB certificate and supporting result.
The clinical team keeps: intake answers and unrelated records.
Notifications show: case status, not clinical results.
Your agency never holds login credentials for record sources.
Privacy practices
How we use and protect information
- We do not sell personal information.
- We do not use health information for behavioral advertising.
- We do not use protected health information to train general-purpose AI models without written authorization.
- A requesting organization receives clinical information only under the individual’s authorization.
- We do not collect genetic information or family medical history for a requesting organization.
- Sensitive information is encrypted during transmission.
- Information is processed on systems located in the United States.
Read the Privacy Policy, Notice of Privacy Practices and Terms of Use.
Privacy contact
privacy.office@getvitalcheck.com
VitalCheck Wellness, Inc. · Attn: Privacy Office / Compliance
241 West 37th Street, Suite 402, New York, NY 10018
Licensed providers make clinical decisions. Your organization decides whether to accept the file and hire the worker.
Clinical results stay inside the dashboard.
Authorized users get an email when a file is ready, then sign in to view the result and signed paperwork. Results stay out of notification emails.
Agencies can give multiple authorized users access to designated records.
The dashboard is HIPAA compliant and operates under VitalCheck’s SOC 2 Type II-examined security controls.