Compliance that doesn't need your attention.
HIPAA, PHIPA, PIPEDA, GDPR — mePro is compliant out of the box. End-to-end encryption, full audit logging, role-based access controls, BAAs available. You focus on therapy; compliance handles itself.
Why it matters
Compliance by default
Standards baked into the infrastructure. You don't have to configure anything special to be compliant.
Audit-ready
Every access, edit, and export is logged. Audit, supervision review, malpractice protection — covered.
Designed for therapy
We're not a generic SaaS retrofitted for healthcare. Therapy is what we built for.
Every detail, designed for therapy.
Every capability inside this feature, ready to fold into your practice from day one.
HIPAA-compliant infrastructure
Encrypted at rest and in transit. BAAs available for all plans. SOC 2 Type II audited.
PHIPA + PIPEDA (Canada)
Canadian privacy frameworks supported. Data residency options for Canadian practices.
GDPR-ready
EU client data handled per GDPR — right to erasure, data portability, consent management.
Role-based access
Therapists see only their clients (unless permission granted). Admins see what's needed for billing. Audit-logged.
Audit logging
Every record access, edit, export, share is logged with timestamp, user, action. 7-year retention.
Encryption everywhere
AES-256 at rest. TLS 1.3 in transit. End-to-end for messaging and video.
Three steps from sign-up to value.
Sign up
Your practice is compliant from day one. No configuration needed for HIPAA, PHIPA, or PIPEDA baseline.
Sign the BAA
Available in your settings. One signature, applies to all client data going forward.
Trust the audit log
Every action is logged. If you ever need to prove compliance — audit, supervision, malpractice — the trail is there.
See it inside the product.
Every feature folds into the calendar you already check, the client chart you already open, the inbox you already manage. No new tab to remember.
Built so you don't have to be the security expert.
Therapists shouldn't have to think about encryption keys, access policies, or audit retention. mePro handles that so you don't have to.
- SOC 2 Type II audited
- HIPAA, PHIPA, PIPEDA out of the box
- GDPR-ready for international practices
- Per-employee role-based access in group practices
Frequently asked questions
Still curious? Reach out to info@mepro.ai or book a 30-minute walkthrough.
Is mePro really HIPAA-compliant?
Yes. SOC 2 Type II audited, BAAs available for all plans, full audit logging, encrypted at rest and in transit. Compliance documentation available for your records on request.
What about Canadian privacy law (PHIPA/PIPEDA)?
Fully supported. Canadian data can be stored in Canadian data centers. PHIPA documentation available for Ontario practices.
Where is my data stored?
US-based AWS data centers by default. Canadian data residency available on Group/Clinic plans for Canadian practices.
What's the data retention policy if I cancel?
Your data is yours. Cancel and we hold for 60 days (in case you change your mind), then provide an export and delete on request. We don't keep data we don't need to keep.
What's the process if there's a security breach?
We notify affected practices within 24 hours of detection, conduct a forensic investigation, and provide affected-individual notification templates per HIPAA breach notification rules (60-day window). Practices retain control of client notification.
Can the BAA be modified for my legal team's review?
On Group/Clinic plans, yes — common modifications (additional indemnification, custom audit rights, specific data residency) are negotiable. On Solo Practice plans, the standard BAA terms apply as written.