Trust and patient data
Built so your practices' privacy review has short answers.
Healthcare buyers ask about patient data before they ask about features. These are the design facts behind every module we build, written so your team can repeat them to practices and partners.
The short version
- Sprint work runs on synthetic or de-identified data, not production PHI.
- Production PHI stays in your cloud, under your access controls.
- Production access only as you grant it, revocable at any time.
- We sign a BAA when the work needs one.
- Anything that reaches a chart or a patient waits for a person.
- Every AI draft, action and approval is logged.
Patient data
We build on synthetic or de-identified data, not production PHI.
The safest data is data we do not hold. Sprints and the AI Scorecard are designed so we do not need it.
How data is handled
- Sprint work runs on synthetic or de-identified data, not on production patient records.
- Production PHI stays in your cloud, under your access controls.
- In production we work only through access you grant, and you can revoke it at any time.
- We sign a BAA when the work needs one, as we have for work inside a client's HIPAA AWS account.
AI controls in every module
- Names and dates of birth removed before any AI call by default.
- Models run under your account's terms, such as Azure OpenAI or Amazon Bedrock, which do not use your prompts for training.
- Anything that reaches a chart or a patient waits for a person.
- An audit log of what the AI saw, drafted and did, and who approved it.
- On or off per practice, with data settings your admins control.
Evaluation
Quality, safety and cost are measured before launch.
Every Sprint ends with evidence, not a demo alone.
What we test
- Quality evals on a test set your team reviews.
- Tests for cross-practice access, prompt injection and PHI leakage.
- A cost-to-serve estimate per practice on two models.
- Practice isolation tested: questions crafted to pull another practice's data return nothing.
For your customers' reviews
- A security overview and a data-flow sheet for each module.
- Help answering the AI sections of security and privacy questionnaires.
- Architecture documentation, the models used and a way to switch the feature off.
We work within your HIPAA, privacy, security and customer requirements, and sign a BAA when the work needs one. Compliance depends on the complete product, contracts, policies and operating environment; Datics does not present software engineering alone as legal certification.
Regulations
HIPAA, in plain terms
We work within your HIPAA, privacy and customer requirements and sign a BAA when the work needs one. Compliance depends on your complete product, contracts, policies and operating environment, so we never present software engineering alone as certification.
Where we are
Austin, Texas, with US-hours overlap.
Working with us
- Datics AI is headquartered in Austin, Texas, where our CEO is based. Product Review calls run in US Central time.
- A named lead engineer and US-hours overlap on every engagement.
See it on your own product.
Bring one product, workflow or AI feature. In 30 minutes we tell you which of the three ways to start fits, what it would cost to serve per practice and what your customers' privacy review will ask.
Calls run in US Central time. No generic AI presentation: we discuss your product, users and production constraints.