Yes, on all three. Patient data is AES-256 encrypted at rest and in transit, held in secure encrypted storage, and we sign a Data Processing Agreement on request. We've been audited for KVKK and GDPR; HIPAA-compliant plans are available for US practitioners on Pro.