Trust and security
MyJourney is designed for clinics that need controlled access, auditability, and clear business-associate terms when HIPAA applies.
MyJourney is built so that a clinic's data stays the clinic's data. Access is least-privilege by default, every sensitive action is attributable, and program information is protected in transit and at rest. The controls below describe how the platform is engineered — not a marketing checklist.
Each organization's records are separated by row-level security on the core clinical tables and enforced application-layer authorization across the platform, so records are returned only to a principal entitled to them. Access is role-based, organization-provisioned, and fails closed: if a permission cannot be confirmed, the request is denied rather than allowed.
Authentication events and governed writes are recorded to a durable, append-only audit trail designed to survive partial failures, giving your team a dependable record for operational review, access investigations, and compliance support.
PHI is encrypted at rest and in transit, secrets and encryption keys are managed outside application code, and administrative, technical, and physical safeguards — MFA, session invalidation, rate limiting, and monitoring — protect sensitive workflows.
When MyJourney creates, receives, maintains, or transmits PHI on behalf of a HIPAA-covered organization, RSBB Group LLC acts as a Business Associate under a Business Associate Agreement.
Subprocessors that handle PHI are subject to appropriate contractual protections, including Business Associate Agreements where required.
Security isn't only prevention — it's what happens around the edges: how long data lives, how it comes back after a fault, and what we do when something goes wrong.
PHI is retained per your organization's instructions and the applicable Business Associate Agreement. On account closure or written request, data is deleted or returned as the agreement requires — your organization stays the custodian of its records.
Encrypted backups and a tested rollback path support recovery, and the platform is engineered to fail closed — denying access rather than exposing data — when a dependency is degraded.
MyJourney maintains incident-response procedures. If a breach of unsecured PHI occurs, we notify the affected organization in line with the Business Associate Agreement and HIPAA breach-notification requirements.
Found a vulnerability? Email security@rsbbgroup.com. We support coordinated disclosure and will acknowledge legitimate reports. Machine-readable contact: /.well-known/security.txt.
Our Business Associate Agreement and subprocessor register are published on this site. Evaluating MyJourney more deeply? Under NDA we can share a detailed security overview and risk-assessment summary. Request the package at security@rsbbgroup.com.