The model never sees a patient's name.
Names, dates of birth, and record numbers are removed before anything is analyzed. What the model reads is clinical text with the identifying details already taken out. It cannot leak a name because it was never given one.
We would rather describe this precisely than generously. Everything below is what is true today, including the parts we do not have yet.
Signed before any patient data moves
Signed before any patient data moves
Not yet — see below
Last updated 31 July 2026 ·
What happens to your data
Four steps, in this order
The order matters. Identifiers come out first, not last.
DATA USE
What your data is never used for.
Never sold.
Never used to train external models.
Never pooled across facilities.
Never retained beyond your agreement.
WHAT WE DO NOT HAVE YET
The gaps, named
We have not been through a SOC 2 audit. The controls are built the way an audit would expect, but that is our word, not an auditor’s.
[CONFIRM: keep or cut] Not yet commissioned. When one is, the report will be available under NDA.
You would be among the first facilities to send us a chart. There is no reference customer to call.
What happens to your data
Four steps, in this order
The order matters. Identifiers come out first, not last.
Your data arrives under a BAA
Encrypted in transit, into an isolated tenant that belongs to your facility alone. Protected health information is expected here. That is what the BAA is for.
Identifiers are separated before analysis
Names, dates of birth, and record numbers are removed from the clinical text and held in a separate encrypted store. The text that continues carries a pseudonym, not a person.
The model reads. It does not decide
A language model reads the de-identified text and reports what the note says. It does not score, decide, or select codes — fixed rules do that, the same way every time.
The finding is re-linked to the resident, inside your tenant
Your staff see a name because the re-link happens on your side of the boundary. The model never did. Every finding also names the manual and section it came from.
During a design-partner review, before any BAA is in place, we ask for a de-identified record instead — nothing identifying leaves your building at all.