Uncharted

HIPAA-ready safeguards, enforced by the architecture.

Patient data never leaves the device, so there is no server holding records to breach. Security is built into the architecture, from the encrypted store to the lock screen.

The architecture in detail.

The safeguards, documented in enough detail for a compliance or security team to evaluate.

Uncharted provides HIPAA-ready technical safeguards. We are not a covered entity or business associate — see the Privacy Policy for the data-handling side of this picture.

Last updated: July 6, 2026

Data at rest

  • Encrypted database. All clinical records live in a SQLCipher AES-256 encrypted SQLite database — including the tamper-evident audit log, app settings, and GPS track, which live inside the same encrypted database.
  • Hardware-backed keys. The database key is generated on the device and never leaves it. On iOS it is held in the Keychain; on Android, the Keystore; on desktop, the operating system’s secure storage.
  • Sandboxed media. Photos, videos, and audio recordings are written only to the app’s private sandbox — never the camera roll — protected by the operating system’s file-level encryption (iOS Data Protection, Android file-based encryption; FileVault or BitLocker on desktop, which we recommend keeping enabled). EXIF metadata, including GPS location, is stripped before save.

Tamper-evident audit log

Every record create, open, edit, export, and delete is written to a hash-chained audit log: each entry stores the previous entry’s hash (prev_hash → row_hash), so any alteration of history breaks the chain and is detectable. The log is stored on-device inside the encrypted database — it is evidence for your organization, not telemetry for us.

No cloud, no telemetry on patient data

There is no sync service, no server-side copy of records, and no analytics or telemetry that touches patient data. The record exists only on the device.

Reporting a vulnerability

We welcome good-faith security research. Report vulnerabilities to contact@unchartedmed.com with “Security Report” in the subject. Include steps to reproduce, affected platform and version, and impact. Please use test data only — never patient data — in proof-of-concept material, give us a reasonable window to fix before public disclosure, and don’t access data that isn’t yours. We will acknowledge reports promptly and keep you informed through the fix.

Questions

Security questionnaires, enterprise security reviews, or anything this page doesn’t answer: contact@unchartedmed.com.