Specs and security
How TransplantCheck protects patient information.
Where patient information lives, how the app reaches the clinic, who we work with, and where we are on SOC 2. Plain answers, nothing overstated.
Ask a security question Vendors and agreements
Patient information stays at the clinic.
TransplantCheck runs on a computer the clinic owns and controls. Patient records are kept there, not with us.
Mental Wealth Solutions, the company that makes TransplantCheck, doesn’t keep a copy. The clinic decides which staff can see which patients, and keeps its records under its own policies.
How the phone reaches the clinic.
The patient’s iPhone connects to the clinic through a relay we run on Amazon Web Services. The connection is sealed from end to end, and only the clinic’s computer can open it.
- What the relay does
- It passes the sealed connection between the phone and the clinic. It can’t read what’s inside, and it keeps no copy.
- What the relay can see
- Which clinic a phone is reaching, when, how much data, and the phone’s network address while it’s connected. It needs these to route the connection and to slow down abuse.
- What the relay writes down
- Only short event notes, clinic IDs, counts and times. Never phone addresses, and never what’s sent.
- How the relay is locked down
- One open door for encrypted traffic, no remote login, encrypted disks and private storage. It runs under our business associate agreement with Amazon.
Staff sign in only at the clinic.
Staff screens can’t be reached through the relay. Staff use TransplantCheck on the clinic’s own network and sign in with the clinic’s own Microsoft 365 or Google Workspace account.
Too many sign-in attempts are blocked for a while, failed sign-ins are recorded, and sign-ins time out after 10 minutes. The clinic’s computer keeps an activity record that its administrators can download.
On the patient’s phone.
The app keeps the patient’s information on the phone and sends it only to the patient’s own clinic.
- Locked storage
- The app’s information uses the iPhone’s highest level of file protection and is left out of iCloud backups.
- Face ID or passcode
- Patients can lock the app with Face ID or their passcode.
- Sent only on purpose
- Nothing reaches the clinic until the patient pairs the app with their unit. Check-ins and journal entries stay private unless the patient taps Save and send.
- Unpair or erase
- Unpair this phone disconnects it from the clinic. Erase everything removes all of the app’s information from the phone.
- Help in one tap
- 988 and 911 are one tap away from any screen.
- No tracking
- No ads, no analytics and no tracking tools.
What the clinic’s computer needs.
A clinic-owned server running Windows Server 2022 or 2025, or Ubuntu 24.04, on a standard 64-bit Intel or AMD machine. No database server or cloud account is needed.
On Windows, the backup tool saves only to an encrypted drive. Our software updates are digitally signed.
No patient information goes to AI services.
TransplantCheck doesn’t send patient information to any AI service.
We use AI tools to help write and check our code. Our rule is that they only ever see made-up data.
Our path to SOC 2.
SOC 2 is an independent audit of how a company protects data. We don’t have a SOC 2 report yet. Here’s where we are.
- Done: our policies are written
- 22 security documents covering access, incidents, backups, vendors, training and more, matched to the SOC 2 criteria and the HIPAA Security Rule.
- Next: we adopt them
- We formally adopt the policies and start keeping the records an audit looks at.
- Then: the audit
- An independent auditor checks us, starting with the Security category. A first report can follow soon after adoption, and a full report after 3 to 12 months of records. We’ll hire the auditor when a clinic needs the report.
- Getting the report
- Once we have one, clinics can ask for the full SOC 2 report under a confidentiality agreement, which is the usual practice.
- Who’s responsible
- Matthew Sexton, LCSW, is our Security Official and Privacy Official. We also carry cyber insurance.
Vendors and agreements.
We have one business associate agreement (BAA), with Amazon Web Services, in effect since October 24, 2026. These are the services TransplantCheck runs on.
- Amazon Web Services
- Runs the relay, and a demo that uses only made-up data. Carries sealed patient connections it can’t open. BAA: signed.
- Cloudflare
- Keeps the address records for transplantcheck.org. No patient information.
- Vercel
- Hosts our support site, support.transplantcheck.org. No patient information.
- Squarespace
- Holds the kidneytransplant.solutions web address. No patient information.
- Let’s Encrypt
- Issues the security certificates for our web addresses. No patient information.
- Apple
- Will deliver the iPhone app through TestFlight and the App Store. We don’t send patient information to Apple.
- GitHub
- Stores our source code. Made-up data only.
- Runs our business email. We ask people not to email medical details. BAA: being checked.
- The clinic’s sign-in service
- Staff sign in with the clinic’s own Microsoft 365 or Google Workspace. That account and its agreement belong to the clinic.
Report a security problem.
Email matthewsextonlcsw@mentalwealthsolutions.org with Security in the subject line.
Please don’t post security problems in public. A person will answer.
Changes.
We update this page when anything here changes.
Last updated
Updated November 1, 2026.