HIPAA Compliant GPT

Protocol release · Data journey

Where clinical content actually goes.

Not a diagram of generic cloud icons. This is the specific sequence a note or transcript moves through inside this product, and what changes at each step.

Data journey

From your keystroke to a readable draft

Four stages. Each one answers what enters, what changes, and what remains.

Step 1

Clinical input

Enters as
A note, transcript excerpt, or pasted case detail
Changes
Identifiable elements are detected and tokenized
Remains
A de-identified working copy, held in your session

Step 2

Model reasoning

Enters as
The tokenized, de-identified copy
Changes
A model drafts, summarizes, or reasons over it
Remains
The model never receives the original identifiable content

Step 3

Reassembly

Enters as
The model's tokenized output
Changes
Tokens are matched back to your original identifiers
Remains
A readable draft, reassembled only inside your session

Step 4

Your review

Enters as
The reassembled draft
Changes
You edit, accept, or discard it
Remains
The record you actually keep is the one you choose to save

Evidence ledger

Retention & subprocessors

What we can say today, and what's still pending a documented answer.

EvidenceProduct (Aug 2026)

By default, session content is retained for a limited period on every plan. You can set retention to zero so nothing is kept after you close a session, or choose unlimited retention on higher plans.

EvidenceNot yet published

Multi-model access means more than one vendor can be involved. We don't yet have a published, kept-current list of which ones. That's an open item, not a secret.

What stays your responsibility

A tokenized pipeline doesn't replace your own judgment.

Tokenizing PHI before it reaches a model reduces what a model provider ever sees. It doesn't change what you're responsible for as a covered entity: deciding what belongs in a chart, reviewing AI-drafted content before it becomes part of a patient's record, and telling patients how you use tools like this one where your own policies require it.

If your practice needs a documented answer for a specific audit question, ask us. We'd rather point you to the real source than let a marketing page stand in for it.