Our Approach to Security & Privacy

Last updated: August 23, 2026

Here's a clear, plain-language explanation of how we protect your patients' clinical information and the legal framework we operate under in Mexico.

What We Do, Technically

Security isn't a box we check at the end—it has been part of the architecture from day one.

• Field-level encryption: Clinical data is encrypted at the field level, both in transit (TLS) and at rest.
• No clinical data in logs: Our logging systems are built so your patients' clinical data never appears in them.
• Every request is audited: Every request to a patient's data is logged, so you can always see who accessed what and when.
• Google Cloud infrastructure: We run on Google Cloud infrastructure, with the network and access controls that come with it.
• Per-therapist access: Each therapist can only access their own patients' records—there's no cross-practice access.

Mexican Legal Framework

We built Ziora to follow NOM-004-SSA3-2012, Mexico's standard for clinical records, and we operate under the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP).

• Privacy notice: Both therapists and patients receive a clear privacy notice explaining how their data is used.
• Informed consent: Patients sign an informed consent before they begin using the platform.
• Per-session recording consent: Every recorded session requires the patient's explicit consent, renewed at each appointment.
• Clinical record consent: Handling of the electronic clinical record follows NOM-004's consent guidelines.
• AI Companionship consent: Using the between-session AI companion is optional and requires its own informed consent.

Let's Be Direct

We don't yet hold formal certifications like SOC 2 or HIPAA—we're an early-stage company, and those audits are part of our roadmap. We'd rather say it plainly: what we do have is an architecture designed from day one to protect clinical data, and we are in the process of formalizing data processing agreements (BAAs) with our infrastructure providers.

Contact Information

If you have questions about this approach or your privacy rights, please contact us at:
privacidad@ziora-copilot.com

This document may be updated from time to time. Please check our website for the most current version.