Nora handles health information for a living. Here's what we promise in writing, and how we keep it.
Nora is one operator: AI runs the system, and trained humans are on the line where judgment matters today. That mix shifts as Nora earns it.
What HIPAA means for a home care operator. What PHI Nora handles, our safeguards, and the Business Associate Agreement we sign with every customer.
Read about HIPAA & BAA →Encryption, access control, audit logging, vulnerability management, incident response — what we run, where, and how we prove it.
Read about Security →A plain-English account of what we collect, why we collect it, who we share it with, and how to make it stop.
Read about Privacy →The rules of the road. Short, plain, and written so both sides know what they signed.
Read the Terms →Administrative, physical, and technical safeguards mapped to 45 CFR §§ 164.308, 164.310, 164.312.
Active · Effective 2026Independent audit against AICPA's Trust Services Criteria — security, availability, confidentiality.
PlannedTokenized at our processor; Nora itself stores no full card data. Payment flow scoped to SAQ-A.
Live via Stripe Level 1Common Security Framework certification, planned after SOC 2 Type II. We will publish the scope.
Planned · 2027Private beta · a handful of agencies
We're onboarding a handful of home care agencies now — get on the list.
Prefer to talk? Book a demo →