Trust
Privacy and security at Okaya
Okaya is a short, private readiness check-in. This page sets out what we collect, who sees it, where it runs and which vendors handle it. It is for members, and for the security and IT teams who review Okaya before a team starts.
- The video never leaves the device.
Okaya keeps a set of points that track how your face moves. Okaya never identifies who you are from your face. There is no facial recognition.
- Individual results stay private to the individual.
You see your own scores and how today compares with your earlier check-ins.
- Leadership sees anonymized, aggregated unit-level readiness only. Never who checked in, how anyone did, or anything they said.
Leaders see group trends, never your result, your transcript or a recording.
- Your conversation transcripts are kept for you only.
You can delete a check-in, and you can turn on encryption for your transcripts with a PIN only you know.
Who sees what
The member
Sees
Their own scores, history, transcripts and summaries, and the sharing setting on each check-in.
Never sees
Anyone else's results.
Leaders and administrators
Sees
Group trends built from the check-ins members share: scores, topics and key emotions, combined. Administrators also manage their organization's members and settings.
Never sees
One person's score, a transcript, a summary, audio or video.
Okaya
Sees
Okaya staff with production access can reach stored data to run and support the service. A member can also share a check-in with Okaya for product quality and support. That setting is off by default.
Never sees
A transcript the member encrypted. Only the member's PIN opens it, and we cannot see it.
Sharing is set on each check-in
Each check-in has a sharing setting the member controls. The organization picks the default, and the member can change it on every check-in, at the time or later. Transcripts, summaries, audio and video are never shared.
The one exception: Safety Monitoring
In most organizations, no one is told anything about a single check-in. A very few organizations, with specific requirements, turn on Safety Monitoring. There, members agree to it before their first check-in, and if a check-in shows a high risk of harm, the organization's administrators can see that it happened and who it was, so they can reach out. They never see the score or what was said.
How Okaya handles a safety concern. Okaya is for adults 18 and over.
What Okaya keeps
Your conversation transcripts are kept for you only. You can delete a check-in, and you can turn on encryption for your transcripts with a PIN only you know. The video never leaves the device.
| Data | What it is | Why |
|---|---|---|
| Account | Email or phone number, name, organization and role. | To sign in and to connect a member to their team. |
| Check-in results | Scores, topics and key emotions. | To show the member their results over time, and group trends when the member shares. |
| Transcript and summary | The words of the conversation with Sanora. | So the member can read back their own check-ins. The member can encrypt transcripts with a PIN. |
| Voice | The audio of the check-in. | How the member sounds is part of the result. |
| Face points | A set of points that track how the face moves. No image is stored. | How the member's expression moves is part of the result. |
| Video | Not kept. | The video never leaves the device. |
Hosting and encryption
- Okaya runs on Amazon Web Services (AWS) in U.S. regions.
- Data is encrypted in transit with TLS and encrypted at rest.
- Databases have point-in-time recovery and deletion protection. Stored files are versioned.
- Signing keys live in AWS Secrets Manager, not in code.
- Error reports have member text removed before they leave our systems.
- Product analytics get account IDs, product events, counts and timings only. No scores, no transcripts, no screen recordings.
Sign-in and access
- Every request to the Okaya API is authenticated.
- Members sign in with an email and password, or with a one-time code sent to their phone.
- Members and administrators can turn on two-step sign-in with an authenticator app, or use a passkey.
- Administrators see their own organization only. The API checks the role and the organization on every request.
Vendors that handle data
These companies process data so Okaya can run. The table lists what each one receives and why.
| Vendor | What it receives | Why |
|---|---|---|
| Amazon Web Services | Account data, check-in records, transcripts, voice audio and face points. | Hosting and storage, email, speech to text (Amazon Transcribe), Sanora's voice (Amazon Polly) and the voice chat (Amazon Bedrock). |
| OpenAI | The text of the conversation. | Sanora's replies, summaries and the safety check. |
| Twilio | Phone numbers and message text. | Sign-in codes, reminders and other text messages. |
| PostHog | Account IDs, product events, counts and timings. No scores, no transcripts, no screen recordings. | Product analytics. |
| Sentry | Error reports, with member text removed. | To find and fix errors. |
| Stripe | Billing contacts and payment details. | Payments. |
| Google reCAPTCHA | A check token at sign-up. | To stop automated sign-ups. |
| HubSpot | Contact details from website forms and customer accounts. | To answer inquiries and manage customer accounts. |
Health records and HIPAA
Okaya is not part of a clinical record and does not connect to an EHR. We do not market Okaya as a HIPAA-covered service.
Okaya is a readiness check-in. It does not diagnose or treat, and it is not a medical device.
Government teams
Government teams can use the commercial platform with no ATO. A dedicated AWS GovCloud deployment is available inside a funded award.
Questions
Can a leader see one person's check-in?
No. Individual results stay private to the individual. Leadership sees anonymized, aggregated unit-level readiness only. Never who checked in, how anyone did, or anything they said. The one exception is Safety Monitoring, which a very few organizations use; see below.
Who decides what the organization sees?
Each check-in has a sharing setting the member controls. The organization picks the default, and the member can change it on every check-in, at the time or later. Transcripts, summaries, audio and video are never shared.
Does Okaya record video?
No. The video never leaves the device. Okaya keeps a set of points that track how the face moves, and there is no facial recognition.
Can a member delete a check-in or their account?
Yes. A member can delete a check-in, or ask to delete their whole account, from the app. A member can also turn on encryption for their transcripts with a PIN only they know.
What is Safety Monitoring?
In most organizations, no one is told anything about a single check-in. A very few organizations, with specific requirements, turn on Safety Monitoring. There, members agree to it before their first check-in, and if a check-in shows a high risk of harm, the organization's administrators can see that it happened and who it was, so they can reach out. They never see the score or what was said.
Who can use Okaya?
Okaya is for adults 18 and over.
Is Okaya HIPAA compliant?
Okaya is not part of a clinical record and does not connect to an EHR. We do not market Okaya as a HIPAA-covered service.
Where is the data hosted?
On Amazon Web Services (AWS) in U.S. regions, encrypted in transit and at rest. OpenAI processes the text of the conversation.
Does Okaya work for government teams?
Government teams can use the commercial platform with no ATO. A dedicated AWS GovCloud deployment is available inside a funded award.