Built for healthcare
privacy and security

BAAs are available on request for covered entities and business associates that require one. Do not upload patient records or PHI unless a BAA is fully executed. Email security@getcredvault.com to request a BAA.

Sycana Health AI LLC (operating as CredVault) is ready to sign a Business Associate Agreement through the platform's BAA management flow. The platform is intended for provider credential metadata — patient health records and clinical notes must not be uploaded. Provider identifiers are access-controlled and audit-logged. Text paths use server-side scrubbing where applicable; binary document analysis is not guaranteed to be anonymized and is disabled unless an organization owner gives the current disclosure consent.

CredVault is built for healthcare practices with encrypted storage, access controls, and audit logging. The platform is intended for provider credential metadata, not patient records. BAAs are available on request for organizations that require one.

Do not upload patient health records, clinical notes, treatment records, or payer files containing patient PHI. CredVault supports provider credential metadata and selected provider identifiers; sensitive provider fields are access-controlled and audit-logged, and should be used only when operationally necessary.

CredVault application data is stored on AWS in the United States. Text-based AI features and optional binary document analysis may use configured third-party providers. Binary documents may contain identifiers and are transmitted only after an organization owner accepts the current disclosure; binary transmission is not represented as fully anonymized. Do not upload patient records, clinical notes, or other patient PHI.

Account data is retained while your account is active. Deletion requests remove all provider and credential data. Exports are available on request before deletion. Backup copies are retained only as long as required by operational necessity.

Practice owners can invite team members and assign role-based access for day-to-day credential work. Access is authenticated, scoped by role, and recorded in audit logs.

Yes. CSV exports are available for credential reports and provider review. Request any needed exports before account deletion because deletion removes provider and credential data.

You retain access until the end of your billing period. After that, your data is held temporarily before deletion. You can request a full export at any time.