Skip to content

Draft document — awaiting legal review

This hipaa & me journal draft (last updated 2026-05-02) describes Me Journal's current practices accurately, but has not yet been reviewed by qualified legal counsel. Until our solicitor signs off, please do not rely on this document for compliance decisions in your jurisdiction. For specific privacy/legal questions, contact privacy@me-journal.com.

HIPAA & Me Journal

Are we HIPAA? — Trust Center FAQ

Last reviewed: 2026-07-07 Public URL: https://me-journal.com/legal/hipaa Sister docs: Privacy Policy · Washington MHMDA · Nevada SB 370 · Trust Center

TL;DR

Me Journal is NOT HIPAA-regulated, because we are neither a Covered Entity (a US health plan, healthcare provider, or healthcare clearinghouse) nor a Business Associate (a vendor that processes Protected Health Information on behalf of a Covered Entity).

We are a consumer wellbeing app. The same regulatory position as Flo, Clue, Apple Health (the data-storage layer), MyFitnessPal, Strava, Headspace, and most journaling apps. The data you put in Me Journal is yours; we are an honest service provider for it; HIPAA does not attach.

That doesn't mean we are unregulated — far from it. We are governed by:

  • UK GDPR + EU GDPR + the UK Data Protection Act 2018 — including Art. 9 special-category-data protections, which functionally exceed HIPAA in many areas (broader consent requirements, stronger Data Subject Rights, mandatory DPIA, 72-hour breach notice).
  • US Federal Trade Commission Health Breach Notification Rule — expanded in 2024 to expressly cover consumer health apps. We follow the FTC 60-day individual notice + 10-business-day FTC notice (for 500+) regime, implemented in our internal FTC HBN runbook.
  • Washington My Health My Data Act (MHMDA) — see the dedicated WA notice.
  • Nevada SB 370 (consumer health data) — see the dedicated NV notice.
  • California CMIA + CCPA/CPRA, Connecticut DPA, Oregon CPA, Texas HB 4 — for US residents of those states.
  • ISO 27001:2022 + ISO 27002:2022 — we align our security programme to these Information Security Management Standards (pre-certification — we do not claim to be certified); our current posture is published at /trust.
  • EU AI Act (mandatory August 2026) — our AI features (an in-app chat assistant and mood-based wellness suggestions, which run only when an AI key is configured, plus Monthly Synthesis, Gratitude Insight and cycle-pattern insights, which are built but currently switched off) are classified as limited risk under Art. 50 and we follow the transparency-obligation regime. Body Compass cycle/health data is not processed by any AI/LLM feature in the current version (cycle-pattern insights are disabled by default — see §4); the AI Act classification for those insights would be re-assessed before any such feature is re-enabled.

If any of the situations in §3 below come to apply, the analysis flips and we will pursue HIPAA-aligned controls + Business Associate Agreements as a matter of priority. Until then, the investment is documented as deferred in OUTSTANDING.md.

1. Why isn't Me Journal a Covered Entity?

HIPAA (45 CFR Parts 160 and 164) attaches to three Covered Entity classes:

  1. Health plans — health insurance issuers, HMOs, government payors, etc. We are not a health plan. We charge for our journaling product, not for health coverage.
  2. Healthcare providers that conduct certain electronic transactions — doctors, dentists, nurses, hospitals, pharmacies. We are not a healthcare provider. We do not diagnose, prescribe, treat, or bill insurers. The app explicitly tells the user we are not a substitute for medical advice (see Body Compass privacy disclosure + every health-related screen). Body Compass cycle and fertility predictions are presented as non-clinical estimates, not diagnostics, and carry an explicit contraceptive disclaimer: Me Journal is not a contraceptive and is not a family-planning method, and must not be relied on to prevent or achieve pregnancy.
  3. Healthcare clearinghouses — entities that translate non-standard data into standard HIPAA transactions. We are not a clearinghouse.

2. Why isn't Me Journal a Business Associate?

A Business Associate is a vendor that "creates, receives, maintains, or transmits" Protected Health Information (PHI) on behalf of a Covered Entity. The user → Covered-Entity flow is the key trigger.

We have no contractual relationship with any Covered Entity. Our users sign up directly, pay us directly, and store their own data — they are individuals, not patients-being-served-by-a-provider. The "on behalf of" link is absent, so the BAA framework does not apply.

Even our Doctor's PDF feature does not create a BA relationship: the PDF is rendered client-side in the user's own browser and delivered to them — they can choose what to do with it. Me Journal never transmits it to a Covered Entity on a Covered Entity's behalf.

3. When would the analysis change?

We track three triggers in OUTSTANDING.md. If any one fires, the HIPAA-aligned controls programme starts the same day:

| Trigger | What it looks like | |---------|--------------------| | B2B health-tech contract | We sign a contract with a healthcare provider, hospital, or insurer to provide Me Journal to their patients/members. We become a Business Associate the moment we accept PHI under that contract. Mandatory BAA, mandatory HIPAA Security Rule (164.312) controls, mandatory HIPAA Privacy Rule. | | US healthcare VC term sheet | A health-focused investor (a16z Bio + Health, Andreessen Horowitz's Bio Fund, Bessemer Healthcare, etc.) issues a term sheet with HIPAA-readiness as a closing condition. We pre-commit to the controls regime before close. | | Direct integration with a Covered Entity | A user-facing integration (Epic MyChart, Cerner, Athenahealth, NHS Digital, etc.) where we receive identifiable patient records from a Covered Entity's systems. Same Business Associate flip as above. |

None of these are currently in flight.

4. What do we actually do that resembles HIPAA, even though we're not regulated?

A lot. Many HIPAA Security Rule controls are good-hygiene defaults that we apply regardless. We've mapped these in our ISO 27001 Statement of Applicability (/trust) and the Body Compass DPIA. Highlights:

  • End-to-end encryption (E2EE) of journal content (including dictated entries), Body Compass daily-entry content (vault-mode is the default for solo users) and the encrypted health profile — equivalent to HIPAA Security Rule 164.312(a)(2)(iv) "encryption + decryption" addressable specification at a stronger level for that content (the operator cannot decrypt; HIPAA permits operator-held keys). A small set of operational health fields the server needs (Body Compass settings and cycle averages, EPDS screening results, and medication name/dose/schedule for reminders) is encrypted at rest on our servers rather than E2EE.
  • Body Compass is private by default (current version). Body Compass is a solo, vault-only reproductive/cycle tracker: end-to-end encrypted on the user's device and held only by them. In the current version we do not share Body Compass health data with anyone, including a partner; that data is not placed on any shared or merged calendar; it is not written out to any external calendar provider (Google / CalDAV / Calendly); and it is not processed by any AI/LLM feature. External calendar connections (ICS / Google / CalDAV / Calendly) are not currently offered at all — the external-calendar-sync feature was switched off on 2026-07-06 pending a security rebuild, so no calendar data flows into or out of Me Journal today. Partner-sharing, shared/merged-calendar, external-calendar-write-back and AI surfaces for Body Compass are disabled by default behind a reversible administrative configuration; re-enabling any of them is governed by a hard re-enable gate (updated authorisation, a re-run DPIA, an updated AI Act classification, and advance user notice — see ADR-2026-06-15). This further reduces the special-category-data exposure beyond the E2EE baseline above. (EPDS postnatal screening remains available and solo; it is screening-only, not diagnostic. EPDS answers and scores are stored server-encrypted at rest — not E2EE — so we can schedule follow-up reminders.)
  • Forensic-grade hash-chained audit log (every admin action and every webhook is recorded in a tamper-evident chain, verified by a daily integrity cron; RFC 3161 timestamp-authority anchoring is built in and will be switched on as part of production hardening). Equivalent to HIPAA 164.312(b) audit controls + 164.308 audit-log review.
  • Role-based access control (Clerk roles + Convex queries gated by requireAdmin()). HIPAA 164.312(a)(1).
  • Automatic locking + session limits — the vault auto-locks after a configurable idle window (30 minutes by default) and the decryption key leaves memory when the tab closes; sign-in sessions default to 7 days on a browser and 14 days on the installed app, per docs/design/PWA_SESSION_DURATION.md. HIPAA 164.312(a)(2)(iii).
  • Integrity controls (daily chain-verification cron + integrity cron; WORM cold-storage archival with R2 Object Lock is built and activates once archive storage is configured). HIPAA 164.312(c)(1).
  • Audit trail of every webhook + admin action, retained 6+ years. HIPAA 164.316(b)(2).
  • Breach notification process — FTC HBN-aligned (described above), GDPR 72-hour-aligned. HIPAA 164.404 / 164.406 / 164.408 are not directly applicable but our process produces equivalent outputs (individual notice, regulator notice, media notice for 500+).
  • Risk Assessment + Risk Register — ISO 27001:2022 6.1.2 + Annex A.5.7. HIPAA 164.308(a)(1).
  • Workforce security + sanctions policy — operator (N) is the sole workforce member; ISO 27002 controls 6.1–6.4 apply.

5. We are explicit when we cannot do something

  • Medication interactions / refill tracking / pharmacy export / taper schedules — explicitly NOT BUILT, documented as "MHRA/FDA Class I medical-device regulatory territory" in MEDICATION_TRACKER.md §10 + FUTURE_GROWTH.md §4.5. (A simple dose register + adherence log IS built.) Users who ask for the excluded features are directed to Medisafe / MyTherapy / Apple Health through our support guidance.
  • Diagnosis / treatment / prescribing — explicitly NOT a feature. Every health-touching screen has a "Me Journal is not a doctor" disclaimer.
  • Crisis support — our AI insight features and the public landing-page assistant run a crisis-keyword check before any LLM call; when it triggers, the LLM is bypassed entirely and a fixed-text message with crisis resources (Samaritans 116 123, the 988 Suicide & Crisis Lifeline, and local emergency numbers) is shown instead of attempting to counsel.

6. Contact + escalations

  • Privacy questions: privacy@me-journal.com
  • Security incidents (suspected): security@me-journal.com
  • Public Trust Center: /trust

Footer: This FAQ is informational and not legal advice. If you are a healthcare provider, a hospital, an insurer, or a vendor operating on behalf of one, and you believe Me Journal should be treated as a Business Associate, please contact us at privacy@me-journal.com before deploying the app to your patients/members. We will review whether the analysis above changes and, if so, pursue a Business Associate Agreement before any PHI crosses the boundary.

Related documents

Privacy PolicyTerms of ServiceCookie PolicySecurity StatementSub-Processors