Security
How Otti protects your records
Otti is built for children's health records, and holds real ones today.
Everything here is in place today, checked against the code that's running. Last reviewed .
At a glance
The short version
Stored in the US, on Google Cloud
Under Google's HIPAA business associate agreement (BAA), and encrypted where stored and in transit.
Every practice walled off
Staff can't open another practice's records, and families reach only their own copies.
Families see only what you share
Separate copies, never the chart itself.
Signed means signed
A signed note's text, time and signer can't be changed in the app.
Backed up every day
Kept for two weeks, plus a seven-day rewind.
AI drafts, you decide
An AI draft never overwrites a note you've typed, and nothing reaches a family until you publish it. When you sign, AI writes a recap (and for a long plan, a summary) beside the note for your next prep.
Hosting
Where your records live
Charts, files and the app's server all run on Google Cloud (Firebase), in the US.
Covered by Google's BAA
Google's BAA is in place for the Google Cloud project holding Otti's records, and covers the services named on Google's HIPAA page.
Encrypted
Google encrypts the records where they're stored, and every connection to Otti uses HTTPS.
Access
Who can see what
Whenever staff open or save anything, Otti checks who they are and which practice they belong to.
Your own account, your own role
Everyone has their own sign-in, and their role limits what they can see and do. Billing staff, for example, can't edit notes.
Practices kept apart
One practice can't open another's records. On every code change, automated tests try to read across practices and families, and the test run fails if any attempt gets through.
Removing someone
It ends their access, even on a device where they're already signed in.
A log of access changes
Otti logs changes made in the app to who can reach your records or payments, such as staff and family access and payment settings, plus whole-chart exports. Only Otti's server can write it, and no one can edit or delete it from the app.
Family portal
What families can see and do
Families sign in to their own portal, apart from your staff. It shows separate copies of what you share, such as visit summaries, appointments and bills, never the chart itself.
What families send back
Families can't edit the chart. What they send from the portal, such as an intake form or a payment, is first checked against their link to that child.
Turning access off
When you turn off a family's access, Otti deletes their portal copies.
Reminder emails
Off until you turn them on. Each says when and where the visit is, and the only detail about the child Otti fills in is their first name. Families can confirm, ask to cancel or stop reminders. You can reword the message or add a note; Otti adds no clinical details.
Your records
Signed notes, backups and deletion
Signed notes are locked
No one can change a signed note's text, time or signer from the app. Corrections go in dated addenda.
Daily backups
Each backup of the records database is kept for two weeks. The database can also be rewound to any moment in the past seven days, and deleted files recovered within seven days.
Deleting a record
When a practice owner deletes a child's record, Otti deletes the chart, its files and the family's portal copies. It keeps a record of the deletion (the child's name, who deleted it and when) and the practice's logs and payment records. Sent emails can't be recalled, and backups keep copies until they expire.
AI
AI, with you in charge
Otti's AI uses Google's Gemini models through Google Cloud's Gemini Enterprise Agent Platform (formerly Vertex AI), in the US, under the same BAA. What an AI feature sends goes nowhere else.
Fixed jobs, never trained on your notes
Each AI feature does one set job, with instructions built into Otti, so it can't be used as a general-purpose chatbot. Otti never uses your notes to train or adjust an AI model: every job starts from the same fixed instructions.
Drafts are yours
An AI draft never overwrites a note you've typed, you apply goal-score suggestions one at a time, and nothing reaches a family until you publish it. AI never changes a signed note. When you sign, it writes a visit recap (and for a long plan, a plan summary) beside the note for your next prep sheet; neither is shown to families.
Logged without the content
Each AI request is logged with who asked, when, which job and its size, never what was sent or what came back.
AI and client data
What the AI is sent
Each AI job is sent only what it needs, and Otti never adds the child's name to a request: a job that refers to the child gets initials.
Drafting a visit note
Your shorthand, the rest of the note when you draft one section, and the child's initials. The AI is told to call the child by initials only.
Evaluations
The evaluation you're writing, with every part of the child's name as recorded in the chart swapped for initials before it's sent, even in your own wording. Test scores aren't sent; your interpretation of them is.
Progress notes
The period's signed visit notes, the goal figures Otti worked out, and the child's initials instead of a name.
Working from your notes
Scoring goals from a note, looking for themes across recent notes, the visit recap, the plan summary and the family summary draft read the notes themselves, plus what each job needs, such as a numbered list of the child's goals.
Whole documents
These send the whole document, including the child's name and anything else printed on it: filling in a new client from an intake form, sorting a previous provider's records, reading goals from an old plan of care, and having AI read a filed document. You check everything before it's saved.
Dictation and questions
Dictation sends the recording. A question to your notes goes first with nothing from the chart, then with only the matching notes: signed ones, plus a previous provider's when you search all of a child's notes.
Otti never adds billing records or another child's notes to a request on its own. Except in evaluations, your own words go as written, as do a previous provider's notes, so writing initials in your shorthand and notes keeps names out of the jobs that use them.
Companies
Companies that handle your data
Google Cloud
- Does
- Hosting, the database, files, sign-in and AI.
- Handles
- Records, under Google's BAA.
Stripe
- Does
- Family payments, if you connect Stripe.
- Handles
- Card and bank details, on Stripe's own secure page; they never reach Otti. Stripe gets the amount and reference numbers, not clinical details.
Cloudflare
- Does
- Serves this website, manages the ottihealth.com domain and forwards mail to hello@ottihealth.com.
- Handles
- No records.
Bills, receipts and reminders that Otti sends to families go through your practice's own email account, so Otti adds no email company. Neither the app nor this site has ad trackers (this site counts visits with Cloudflare's cookie-free counter), and we don't sell data.
Engineering
How Otti is built and checked
Otti's founder is a governance, risk and compliance professional focused on vetting vendors like Otti, and runs Otti the way they would want a vendor run.
Tested on every change
Every code change runs the full automated test suite, attack tests included. Automated tools check the outside software Otti uses for known security flaws and propose updates, which are tested like any other change.
A person starts every release
Changes are checked on a separate test copy first, and nothing reaches the live app automatically.
Strict rules for browsers
The app tells browsers to run only its own code, plus Stripe's for payments. It can't be embedded in other sites and loads no ad or analytics scripts.
Reviewed in-house
We review Otti's security ourselves, with help from AI tools, against OWASP's widely used guidance on common web-app weaknesses.
Your part
What your practice looks after
- Decide who gets an account and which role, and remove people the day they leave.
- Use a strong, unique password, and lock the phones and computers you chart on.
- Choose which families to invite and what to share with them.
- Secure your practice's email account; Otti sends family email through it.
Report a problem
Reporting a security issue
Found a security problem in Otti or this site? Email hello@ottihealth.com with "Security" in the subject, and tell us what you found, where, and how to reproduce it. Please don't send any patient or family information.
- In scope: ottihealth.com and app.ottihealth.com.
- Don't access, change or keep anyone else's data. If you come across patient or family information, stop and tell us.
- No denial-of-service testing, and no social engineering of Otti, the practices using it, or their families.
- Research within these rules is welcome. There is no paid bug bounty.
Clinics can send security questionnaires there too, and automated tools can find the address in our security.txt.
Email hello@ottihealth.com