Security & HIPAA. What we built to protect patient data.

The entire system runs on Amazon Web Services using HIPAA-eligible services, covered by a signed AWS Business Associate Addendum. AWS is our only infrastructure subprocessor; the one other PHI-touching service is the HIPAA fax carrier behind one-click REMS filing, under its own signed BAA.

Every connection uses TLS. Everything stored (the database, its automated backups, and the audit log) is encrypted at rest on a customer-managed AWS KMS key. No unencrypted copy exists.

The database runs in a private network with no public address. Application traffic reaches it through the app; nothing is exposed directly to the open internet.

An AWS Web Application Firewall sits in front of the site with managed rule groups and a per-IP rate limit, and the application enforces its own rate limits and a per-clinic staff-PIN lockout.

Owner accounts use two-factor sign-in (an authenticator app or a texted code), and the requirement is on by default for every new clinic. One-time recovery codes provide a safe way back in if a device is lost. A clinic that turns two-factor off must change its owner password every 45 days instead.

Owner sessions time out after fifteen minutes of inactivity and have a twelve-hour absolute cap, so an unattended reception screen doesn't stay open.

Clinicians use a daily clinic code and a personal PIN on their own phones: no shared passwords, and a lockout after repeated wrong PINs.

Day to day, our platform tools show clinic-level counts. If we ever open a clinic's records, the tool requires a typed reason first, and the access is written to that clinic's own audit log where you can read it.

For each patient: name, date of birth, sex, contact details and address, medications and any conditions you record, the prescriber, and the session itself: vitals, observations, lot numbers. The address is there because the REMS enrollment form asks for one, which the monitoring form does not. Alongside the treatment day, a patient record holds what the course needs: PHQ-9 and GAD-7 answers and scores, a note per visit, their appointments, and, only if you switch reminders on, an email address to send them to. There is no Social Security number, no insurance or policy number, and no billing or claims data anywhere in it.

A Lucido Lite clinic keeps a basic roster: each patient's name, date of birth, and how their Spravato® is supplied. There is no patient record, no REMS form and no fax, and Lite sends patients nothing. On both plans, the patient named on a carton given to them stays on that carton's record for two years after its last movement, because that is the administration record DEA expects kept.

There is no analytics or ad code in the product, and nothing is shared with data brokers. The one outbound path for a form is the one you press: one-click REMS filing, over a BAA-covered HIPAA fax service. Billing runs on Stripe with billing data only, never PHI.

Once a session is discharged it's locked. Every action that touches patient information lands in an append-only audit log that can't be edited or deleted, retained seven years and exportable by the clinic at any time.

Two clocks, both yours. Completed session records, meaning the treatment day with its vitals and its monitoring form, are hard-deleted on the window you set: 28 days by default, anywhere from 1 to 90. Assessments and clinical notes keep a separate, longer window, a year by default, because a PHQ-9 trend drawn over two weeks is a single dot. Lucido runs the treatment day and the course around it; it is still not your chart of record, and clinics keep their own copy through exports.

Closing the account runs the wind-down the BAA describes: an export window first (the filed REMS PDFs and the audit-log CSV), then deletion of the clinic's records and the owner's login.

Esketamine records are mental-health treatment records, and some state laws, like the Illinois Mental Health and Developmental Disabilities Confidentiality Act (740 ILCS 110), protect them more strictly than HIPAA. Lucido is built to that stricter standard. Patient data is disclosed only to the clinic, to AWS, and — when the clinic files by one-click fax — to the REMS program via a BAA-covered fax carrier; no other third-party data egress, and redisclosure notices on the records the product generates.

We maintain a HIPAA security program in writing (a security risk analysis, incident-response and breach-notification procedures, and workforce policies), kept current as the product changes.

A multi-region CloudTrail records infrastructure activity to write-once storage with seven-year retention, alongside the application's own append-only audit log.

Point-in-time database backups are encrypted, and we have restored from them for real: a June 2026 production drill brought a full copy back in about twelve minutes, with a measured data-loss window of about six minutes.

Error-rate, latency, and uptime alarms page the team automatically, so problems surface before a clinic has to report them.