Encryption is the foundation of health data security, but encryption that is poorly implemented provides little protection. This article explains in plain language exactly how Looms encrypts your health data — not as a marketing statement, but as a transparent description of the specific technical controls in place.
Encryption at rest
All health data stored in Looms databases is encrypted using AES-256, the same standard used by government and financial institutions for their most sensitive data. Encryption is implemented at the application layer — meaning the data is encrypted before it is written to the database, not just at the storage level. Even in the unlikely event that a storage volume was physically removed, the data it contains would be unreadable.
Encryption in transit
All communications between your device and the Looms platform — viewing a record, booking an appointment, receiving a notification — are encrypted using TLS 1.3, the current version of the standard used for secure web communications. Older TLS versions (1.0 and 1.1) are not accepted.
The Looms mobile app implements certificate pinning, which prevents a category of attack where a malicious party inserts themselves between your device and the server by presenting a fraudulent certificate.
Key management
Encryption keys are managed using hardware security modules (HSMs) — dedicated physical devices that store and process cryptographic keys in a tamper-resistant environment. Keys are rotated annually. Rotation events are logged and audited.