We follow HIPAA (the US privacy law for health data). And we take the security precautions I think you'd expect -- encryption in transit and at rest, MFA, running service accounts under least privilege, everything is in a VPC, dedicated secret manager, threat detection. While these are the "basics" that you'd expect from a modern tech company, they're not always practiced consistently in healthcare.