For Everyone · Updated Nov 5, 2026
HIPAA and Healthcare Data
Below, you’ll find more on how Scowtt works with organizations in regulated industries (such as healthcare) to grow their business while staying compliant.
Does Scowtt require PII or PHI?
Our models primarily use customer journey activity, conversion events, and downstream business outcomes to predict customer value and improve advertising performance. Certain advertising integrations may use hashed identifiers or advertising click IDs for matching and attribution.
Scowtt's core predictive modeling workflows do not, on their own, require Protected Health Information (PHI) or raw personal identifiers. If you believe your deployment involves PHI, please contact us before connecting healthcare data sources. Our team can help you determine appropriate configurations and identify any additional compliance or contractual requirements, or whether our workflows can be configured to avoid exposure of PHI.
How does Scowtt protect customer data?
Scowtt follows a customer-isolated data architecture:
- Customer data and models are maintained in isolated environments with access controls.
- Customer data is not pooled or shared across customers.
- Models are trained on each customer's data, without cross-customer training.
These safeguards support data confidentiality and privacy but do not independently establish HIPAA compliance.
Is Scowtt HIPAA certified?
HIPAA does not have an official government-issued certification program.
Whether HIPAA obligations apply to a particular Scowtt deployment depends on the services provided, the data processed, and the nature of the customer integration.
Scowtt has completed a SOC 2 Type II examination, which provides independent assurance regarding its security controls. SOC 2 Type II and HIPAA are separate assurance and regulatory frameworks.
What if my organization has HIPAA requirements?
If your organization is subject to HIPAA, please contact the Scowtt team before connecting healthcare data sources.
We can review the proposed integration, data fields, identifiers, conversion events, and advertising destinations to determine appropriate configurations and identify any additional compliance or contractual requirements.