Data Storage & HIPAA Summary
Where Sports Med Flow Pro data lives, how it is protected, and how long it is kept.
Structured app data
Athletes, visits, SOAP notes, referrals, equipment, audits, and more live in a Supabase PostgreSQL database. All 129 tables are protected by Row Level Security.
Files & PDFs
Signed BAAs, SOAP PDFs, credentials, compliance evidence, CareConnect documents, and campus proofs are stored in private Supabase Storage buckets and served through time-limited signed URLs.
Offline queue
While you are without signal, writes are queued in the browser’s IndexedDB / localStorage. The cache is cleared on sign-out; pending writes are preserved until they reach the server.
Audit trails
Immutable, hash-chained audit records are kept in the database alongside tamper-evident compliance receipts.
All traffic between the app and backend is encrypted in transit with HTTPS/WSS.
Database storage and Storage buckets are encrypted at rest by Supabase.
Sensitive athlete fields — student ID, date of birth, parent contacts, notes — are encrypted in the database using a key stored in Supabase Vault.
Every table has Row Level Security enabled. Users can only access data inside their own workspace, and workspace roles (owner/trainer/viewer) further restrict actions.
- PHI / medical records: default 84 months (7 years) from workspace retention settings.
- BAA / compliance documents: configured per agreement version with a chosen deletion method and window.
- Offline sync trails: kept on the device for the current shift and trimmed automatically; confirmed records are retained on the server.
- Audit logs: immutable and retained according to your workspace retention policy.
AWS BAA: Active as of August 30, 2026 for AWS account 735394850504, accepted through AWS Artifact.
Sports Med Flow Pro BAA: Required for Organizations, Campuses, Districts, and CareConnect physician-office connections. Individual Athletic Trainer accounts sign the Master Agreement and Data Use Agreement instead.
- We do not store athlete face photographs. Face matching for kiosk check-in uses on-device mathematical descriptors only.
- We do not sell or share data with advertisers.
- We do not allow one workspace to see another workspace’s records.
For data-residency questions, export requests, or to request a Business Associate Agreement, email saarlacantera@gmail.com.