trust.hero_heading_1
trust.hero_heading_2
trust.hero_body
Last reviewed: 2026-05-26
trust.ai_section_heading
trust.ai_section_body
trust.hitl_gate_title
trust.hitl_gate_body
trust.hitl_confirm_title
trust.hitl_confirm_body
trust.hitl_boundaries_title
trust.hitl_boundaries_body
How your health data moves
Your protected health information (PHI) is subject to strict routing rules. Here is exactly where it goes and how it is protected at each step.
PHI stays in Supabase + AWS
All health data at rest lives in your Supabase PostgreSQL database (BAA on file). PHI fields — chat messages, medical records, mental health notes, lab results, session transcripts — are further protected with AWS KMS envelope encryption.
AI gateway enforces PHI exclusion
Every LLM request passes through a centralised AI gateway. The gateway blocks PHI from reaching OpenRouter and Kie.ai (no BAA). Until Anthropic and OpenAI BAAs are signed, the gateway strips patient-identifiable context before any external LLM call.
Contextual RAG is actor-scoped
When relevant clinical context is retrieved to answer a question, it is retrieved under Row-Level Security — a professional only sees their own clients' data, a client only sees their own. PHI-containing RAG chunks are flagged and excluded from non-BAA LLM requests.
Model routing is superadmin-controlled
The AI Model Control Panel (/superadmin/model-control) exposes the active model for every feature surface. Each policy records whether PHI is permitted and whether a BAA is required. Policies with PHI enabled and no BAA are flagged as compliance risks.
trust.encryption_heading
Encryption architecture
trust.encryption_kms_title
trust.encryption_kms_body
KMS envelope pattern
Each PHI field gets a unique Data Encryption Key (DEK) generated per write. The DEK is immediately wrapped by AWS KMS and discarded from memory — only the KMS-wrapped DEK ciphertext is stored alongside the field. This means a database breach alone cannot expose PHI without also compromising the KMS key.
trust.encryption_oauth_title
trust.encryption_oauth_body
trust.encryption_rls_title
trust.encryption_rls_body
trust.providers_heading
trust.providers_baa_explainer
AI & LLM providers
| trust.providers_col_name | trust.providers_col_baa | trust.providers_col_phi | trust.providers_col_use |
|---|---|---|---|
| Anthropic (Claude) | Pending signature | trust.providers_phi_no | Command parsing, clinical reasoning — PHI blocked at gateway until BAA is signed |
| OpenAI (GPT-4o / Whisper) | Pending signature | trust.providers_phi_no | Agent reasoning, voice transcription — PHI blocked at gateway until BAA is signed |
| OpenRouter | No BAA available | trust.providers_phi_no | Development LLM gateway (non-PHI only); PHI exclusion enforced at API gateway layer |
| Kie.ai | No BAA available | trust.providers_phi_no | Generative utility tasks (non-PHI only); PHI exclusion enforced at API gateway layer |
Infrastructure & services
| trust.providers_col_name | trust.providers_col_baa | Notes |
|---|---|---|
| Supabase (Enterprise) | BAA on file (Enterprise) | Primary data layer — Postgres, Auth, Storage, RLS. All health data stored here. |
| AWS KMS | BAA on file | Column-level encryption key management. All PHI fields use KMS envelope encryption. |
| VAPI | Required before go-live | Live session voice calls — transcripts contain PHI. Not active in production until BAA is signed. |
| Composio | Required before Phase 2 | Google Workspace / Wearable integrations — requires BAA verification before PHI flows through it. |
| Resend | No PHI in emails | Transactional email (confirmations, reminders). No health data included in email content. |
| Upstash (Redis + QStash) | No PHI stored | Rate limiting, caching, and async job queue. No health data persisted in Redis or QStash payloads. |
| Stripe | Payment only | Subscription billing only. No health information is shared with Stripe. |
| Sentry | No BAA available | Error tracking — PHI is scrubbed before any report is sent. Patient identifiers are never included. |
| Slack / Discord | No BAA available | Professional notification channels — summaries only. Raw health data is never sent. |
BAA status reflects agreements executed or pending as of 2026-05-26. “Pending signature” means the provider offers a BAA and we are in the process of executing it.
trust.ed_safe_heading
trust.ed_safe_body
trust.hitl_transparency_heading
Transparency & escalation
trust.hitl_transparency_attribution
trust.hitl_transparency_sla
Clinical actions that require human review include: medication additions and changes, macro target updates, GLP-1 protocol dose adjustments, and any AI output that triggers a crisis detection flag. These actions are queued in the HITL review system and cannot execute until a qualified professional approves them.
trust.rights_heading
trust.rights_refund_title
trust.rights_refund_body
trust.rights_cancel_title
trust.rights_cancel_body
trust.rights_export_title
trust.rights_export_body
trust.rights_deletion_title
trust.rights_deletion_body
trust.directory_heading
Professional directory
trust.directory_credentials
trust.directory_reviews
trust.directory_fees