✓ ArriveWell
Security & trust

Patient trust, by design.

ArriveWell helps clinics guide patients through a medical procedure, and that only works if patients and clinics trust how their information is handled. This page is a clear account of how we protect it.

How we handle information

Built around protecting patients.

No PHI in messages

No diagnosis, results, or insurance details appear in any text or voice message. We record delivery status and message IDs — never the message contents.

Consent-based enrollment

Patients opt in by giving verbal consent to their clinic's staff at the time they schedule, recorded before any message is sent. Enrollment can't be completed without it.

Physician-owned content

Every clinical message is owned and signed off by the clinic's physicians. Wording changes create a new, permanently traceable version — so every message a patient ever received can be traced to its exact approved source.

Private, unguessable links

Each patient's checklist page is reached through a tokenized link — no account, no password — that can't be guessed or searched for, and carries a no-index flag so it never appears in search engines.

STOP, instantly

A patient can reply STOP at any time to end all messages immediately, and HELP for help. Messages are held to clinic hours (8am–8pm), with only the day-of dose and arrival reminders allowed earlier so they land on time.

Minimum necessary

We collect only what the service needs: a patient's name, mobile number, and appointment details. No more. This follows HIPAA's minimum-necessary principle.

Access-controlled dashboard

Clinic staff authenticate to reach the dashboard; each clinic sees only its own patients, and administrative actions are recorded in an audit log.

Encrypted in transit

All traffic to patient pages, the dashboard, and our systems is served over TLS (HTTPS).

Our compliance posture

ArriveWell is built to meet the standards clinics and patients expect.

HIPAA

When ArriveWell handles patient information on a clinic's behalf, we act as a Business Associate under HIPAA, and the clinic is the covered entity. We sign a Business Associate Agreement (BAA) with every clinic before any patient data is shared, follow the HIPAA Security Rule, and apply HIPAA's minimum-necessary principle to everything we collect and send.

Our vendors

Where we rely on vendors that may touch protected information — for example, our text-message carrier and our hosting provider — we use HIPAA-eligible services and put the appropriate agreements in place with them.

What we collect — and what we don't

For patients: a first and last name, a mobile number, and appointment and preparation details — supplied by the clinic. We never put a diagnosis, test result, or insurance detail in a message, and we never sell or share a patient's number or messaging consent for anyone's marketing.

For clinic visitors: if you request a demo on this website, we collect the details you submit (name, work email, practice name, role) to respond to you. This site does not use advertising trackers.

For patients: your choices

Reply STOP to any message to end all reminders immediately, or HELP for help. Your participation is always optional and never affects your care. For anything about your own procedure, contact your clinic directly.

Reporting a security concern

If you believe you've found a security or privacy issue, please email info@arrivewell.health and we'll respond promptly.

This page describes our current practices and is provided for transparency. It is not a contract. Clinic obligations and data handling are governed by the agreement between ArriveWell and the clinic.

SMS Program & Consent  ·  SMS Privacy Policy  ·  SMS Terms & Conditions