Health data is among the most sensitive data a person generates. A financial record tells you what someone spent. A health record tells you how they live, what they fear, what they're managing and sometimes how long they have. The security architecture of a health platform needs to reflect that gravity. Here is how Looms protects your data.
Encryption
All health data is encrypted at rest using AES-256, implemented at the application layer in addition to storage-layer encryption provided by our cloud infrastructure provider. All data in transit uses TLS 1.3 minimum with certificate pinning on mobile clients. Encryption keys are managed using hardware security modules with quarterly rotation.
Access control
Access to your health data within the Looms system is governed by role-based access control with the principle of least privilege: every user, whether patient, clinic staff or Looms employee, has access to exactly what they need and nothing more. All privileged access by Looms staff to production systems requires multi-factor authentication and is logged for audit.
Third-party testing
We engage an independent penetration testing firm to conduct comprehensive security assessments twice per year. Every finding is triaged and remediated according to a severity-based timeline — critical findings within 24 hours, high findings within seven days. We do not consider the absence of a known finding to mean the absence of a vulnerability.
Incident response
Looms maintains a documented incident response plan tested through tabletop exercises twice per year. In the event of a security incident affecting patient data, we are committed to notifying affected users within 72 hours of confirmed impact, in accordance with applicable data protection regulations.