Security

Last updated November 4, 2026

Pare Labs, Inc. (“Pare”) provides supply chain software for surgery centers and hospital operating rooms. This page describes how the Pare product at app.pare.health is built and run: where a facility’s data lives, who can reach it, and what Pare does and does not collect. The website itself is covered by the Privacy Policy. Every statement here describes what is in place today. When something changes, the date at the top moves.

1. What Pare holds, and what it does not

What it holds. Items and their counts, locations, reorder levels, orders, vendors and their representatives, the surgical schedule (surgeon, room, time and procedure), to-dos, and the conversations a facility’s staff have with Pare’s assistant.

What it does not hold. No patient names, identifiers, dates of birth, diagnoses, or any link between a patient and a procedure. The database has no field for a patient. When a schedule export is uploaded, its patient columns are dropped as the file is read, and the file itself is not stored.

Vendor email. When a facility connects an Outlook mailbox, Pare reads vendor mail to propose order updates for a person to confirm. Messages are read in memory and are never stored. Pare cannot send from the mailbox: the permission that would allow sending is refused when the mailbox is connected, and any email Pare drafts is left in the person’s Drafts folder for them to send.

2. Where it runs

Pare runs on Amazon Web Services in the US West (Oregon) region, on services AWS lists as HIPAA-eligible. The database and the application servers sit in private subnets with no public address. A facility’s users reach the application only through the load balancer, after signing in.

3. Encryption

In transit. Connections use TLS 1.2 or later, and plain HTTP is redirected to HTTPS. The application’s connection to the database requires TLS.

At rest. The database, stored files, backups, logs and secrets are encrypted with a customer-managed key that Pare controls and that rotates every year.

4. Who can sign in

• Accounts are created by invitation from a facility’s own site manager. There is no self sign-up.
• Sign-in is handled by Amazon Cognito at the load balancer, before a request reaches the application. Pare stores no passwords.
• Passwords are at least 14 characters. Multi-factor authentication with an authenticator app is available on every account.
• A session ends after 8 hours. Sign out ends it immediately.
• Four roles decide what a person can do. Staff can count and work with orders but cannot edit items or manage the site. A viewer can only read.
• Each facility’s rows are isolated in the database by row-level security: a query runs for one site and can see only that site.
• Access is removed by revoking a person’s membership.

5. What is recorded

Changes to items, counts, reorder levels, orders, receipts, to-dos, memberships and settings, whether made by a person or by Pare’s assistant, are written to an audit log with who made the change, when, and the value before and after. Application, database and network logs are kept for 90 days, encrypted.

6. Backups

The database is backed up automatically every day with point-in-time recovery. Backups are kept for 14 days, encrypted. Deletion protection is on: the database cannot be deleted until that protection is removed first.

7. The assistant

Pare’s assistant is Anthropic’s Claude, reached over Anthropic’s API. It reads a facility’s own records to answer questions, and it can change inventory only in ways the person asking could change by hand. Every change it makes is listed under its answer and can be undone. Patient details are removed from text before it reaches the model, and every sentence of an answer is checked before it is shown. Anthropic does not use data sent through its API to train its models.

8. Usage analytics

Pare uses PostHog to understand which screens are used. Text and element attributes are masked before an event leaves the browser, there are no session recordings, and a web address is stripped to the page and its view settings. No patient data, item names or surgeon names are sent.

9. Subprocessors

Amazon Web Services (hosting), Anthropic (the assistant) and PostHog (usage analytics). Microsoft is involved only when a facility connects Outlook, and then only through the facility’s own Microsoft 365 tenant, which Pare reads vendor mail from and places drafts in. A current list is available on request.

10. Business Associate Agreement

Pare signs a Business Associate Agreement with each customer before any of its data is handled.

11. Reporting a security issue

Write to security@pare.health. We acknowledge a report within two business days and fix a critical issue within seven. If you need to encrypt your message, say so in a first message and we will send a key.

12. What we do not claim

There is no such thing as a HIPAA certification, and Pare displays no compliance seal. Pare has not undergone a SOC 2 audit. A security overview and answers to a security questionnaire are available on request at the address above.