Clear safeguards.
Honest boundaries.
Readiness work is in progress
Us in Bloom is not currently represented as HIPAA-compliant or approved for regulated clinical records. Please do not upload patient records on the assumption that a HIPAA agreement or compliance program is already in place.
Who operates the service
SARA operates Us in Bloom at 1033 S College St, Winchester, TN 37398. Privacy questions: privacy@usinbloom.com. Security concerns: security@usinbloom.com. Garrett is SARA’s designated Security Officer for Us in Bloom.
Safeguards in the product
- Relationship content is encrypted in your browser before upload.
- Professionals require operator approval and active organization agreements and readiness approval. Both partners approve each shared report, and either can revoke future access.
- Passkeys protect sign-in. Sessions expire after 15 minutes without interaction and have a 12-hour maximum lifetime.
- Security access records identify accessed record versions and shared reports using keyed references, while omitting relationship content, message bodies and raw invitation keys. Sensitive reads stop if their audit record cannot be saved. A separate Azure archive protects saved batches from application deletion and overwrite.
- Microsoft Azure hosts the service; secrets are managed through Key Vault.
What remains before regulated use
SARA must complete and document its risk assessment, applicable provider and vendor agreements, privacy accountability, workforce procedures, incident response, access review and recovery validation. A controlled policy and SOP packet has been prepared; adopting those documents and demonstrating that the procedures work remain part of the readiness process. Further work includes completing alert-response exercises, approving archive retention controls, validating recovery and resolving clinical retention and rights workflows. Organization access remains disabled until agreement and release evidence are recorded. Hosting on Azure and encrypting data do not by themselves make an application HIPAA-compliant.
For therapists and counselors
Professional signup and report-sharing consent do not create a Business Associate Agreement or authorize clinical records. Contact professionals@usinbloom.com to discuss your intended workflow before using the service on behalf of a covered healthcare organization. We do not promise that a BAA or clinical service is currently available.
Learn more
Privacy & trust center · Privacy policy · HHS guidance on cloud services · Microsoft Azure HIPAA offering