Consulting
Health data privacy and AI security for organizations that can't afford to get it wrong.
We help health-tech companies, therapy platforms, clinics, and ed-tech teams build privacy-conscious systems and use AI responsibly — before a breach or a regulator forces the conversation.
Who we work with
Health-tech startups
Building products that handle PHI or sensitive family data and need privacy baked in from the start.
Therapy & clinical platforms
Telehealth, ABA, speech, OT, PT, and other therapy platforms managing session notes, progress data, and provider communications.
Special education & ed-tech
Platforms serving students with IEPs, 504 plans, or other special education needs — where FERPA and IDEA intersect with HIPAA-adjacent data.
Nonprofits & advocacy orgs
Organizations serving families of children with disabilities who collect sensitive data but lack dedicated privacy staff.
What we do
Privacy program design
We help you build a privacy program that fits your organization — policies, data inventories, consent flows, retention schedules, and vendor review processes. Practical, not theoretical.
AI risk review
Using AI in a product that touches health or family data? We review your AI integrations for data exposure risks, model training concerns, and consent gaps — and help you document what you're doing and why.
Secure architecture review
We review your system architecture for data security risks: access controls, encryption, logging, third-party integrations, and data flows. We give you a prioritized list of what to fix and how.
Incident response preparation
We help you build a breach response plan before you need one — notification procedures, internal escalation paths, and documentation that holds up under regulatory scrutiny.
Vendor and third-party review
Your privacy is only as strong as your weakest vendor. We review your third-party integrations and help you ask the right questions before signing a BAA or sharing user data.
Staff training & awareness
Privacy and security are team problems. We build practical training for your staff — not compliance theater, but real guidance on how to handle sensitive data day to day.
How we work
We don't sell compliance theater. We work with small and mid-size organizations that need practical, honest guidance — not a 200-page report that sits on a shelf. Engagements are scoped to your actual situation, delivered in plain language, and designed to leave your team more capable than when we started.
Engagements are available on a project basis or as ongoing advisory retainers.
Start a conversation
Tell us a bit about your organization and what you're working on. We'll follow up within two business days.
No sales pitch. Just a real conversation about your situation.
We'll tell you honestly if we're not the right fit.
Engagements are scoped to your actual needs — not a fixed package.