Request a Demo

Security & privacy

Your health data stays yours.

Labs, care plans, and company information hold some of the most sensitive information you have. We protect it with the safeguards healthcare requires.

How we protect it

Safeguards built into rootOS

Security isn’t a feature we add on. It shapes how we build the platform, how our team works, and which partners we choose.

  1. Private by design

    All health information is encrypted. You control who can see your data. We never sell or share it with advertisers or data brokers.

  2. Secure by default

    Security is built into every layer of Root. From authentication to infrastructure, we use strong encryption, trusted identity controls, and modern security tooling to keep your information protected.

  3. Smart, continuous protection

    Our platform uses real-time monitoring, automated threat detection, and always-on scanning to stop issues before they reach you.

  4. Responsible with data and AI

    We’ve built Root with responsible technology from the start. Any use of AI at Root follows strict privacy and security controls.

Standards we hold ourselves to

As a clinical provider, Root operates under the same privacy rules as your doctor’s office and your hospital.

HIPAA

Health Insurance Portability and Accountability Act

We follow HIPAA privacy, security, and breach notification rules for all protected health information.

SOC 2

SOC 2 Type II

Our controls for security, availability, and confidentiality are audited annually by an independent firm.

Audited

Independently Verified

Trusted third parties regularly assess Root to ensure it meets the highest standards for data protection.

Common questions

No. Your employer receives only de-identified, aggregate data — for example, overall participation and outcome trends. They never see your individual labs, diagnoses, or conversations with your care team.

No. We do not sell personal or health information, and we do not share it with advertisers.

Email privacy@rootfunctionalmedicine.com or message your care team in rootOS. Some records must be retained for a period required by medical recordkeeping laws; we'll explain anything we can't delete.

We have an incident response plan in place. If your information is affected, we'll notify you promptly as required by law and explain what we're doing about it.

Offer care your team can trust.

Root brings clinically validated functional medicine to your people, with the privacy and security your benefits program requires.

Root for employers Read our privacy policy