Security & privacy
Health data deserves database engineering.
Security comes from the architecture. Here is how CHIRON protects what matters, in plain language.
Per-clinic isolation (RLS)
Row Level Security in the database: each clinic sees only its own patients. Isolation is enforced by the database, not by the goodwill of the code.
End-to-end encryption of traffic
TLS in transit and encryption at rest in the infrastructure. Credentials with strong hashing and sessions with secure renewal.
Audit trail
Sensitive access and actions are recorded: who saw it, who changed it, when. Traceability is a prerequisite for accountability.
RBAC: least privilege
Roles and permissions by function (physician, nursing, front desk): each person reaches only what they need in order to provide care.
Where the data lives, plainly
Charts, photos and messages live in a managed database hosted in the U.S. (Oregon), with encryption at rest. AI inference also runs on U.S. providers, always with direct identifiers removed. The subprocessors, by what each one does, are below.
AI with identifier reduction
Before any call to AI providers, national ID, phone, email and the patient's name are replaced by markers. The model reads the clinical picture without knowing whose it is; the patient still sees their own name in the answer.
The data's path, in three stops
Collection with consent
The patient consents on first access; the clinic sets the purpose. Nothing is collected “just in case”.
Isolated and audited processing
RLS per clinic, RBAC per role, auditing per action. AI only receives content with identifiers reduced.
Retention with purpose
Data kept for the clinically and legally required period. On termination, the clinic exports everything before deletion.
Regulatory classification
CHIRON is not a medical device and does not intend to be. The intended use declared below is what defines that classification, and it holds for the contract, for the product and for everything we say in sales.
CHIRON is a platform for communicating, organizing and documenting follow-up between visits: post-operative, dental, chronic-condition and post-consultation. It records what the patient reports, organizes those records for the care team and eases contact between the two sides. The software does not assess, measure, classify or interpret a clinical condition: every clinical reading is made by a qualified healthcare professional, who remains fully responsible for the course of care.
What the software does not do
- Does not issue a diagnosis, a diagnostic hypothesis or a report.
- Does not clinically interpret images, exams, biological signals or laboratory results.
- Does not calculate or assign severity, prognosis or probability of clinical outcome.
- Does not prescribe, does not adjust doses and does not suggest therapeutic conduct.
- Does not discharge, does not indicate procedures and does not define clinical referral.
- Is not an emergency channel: it does not summon help and is not monitored in real time by an on-call team.
- Does not write clinical information into the record without explicit confirmation from an identified professional.
The photo the patient sends is stored and forwarded for human review. The app only checks whether the image is sharp and framed: a photography check, not a wound check.
Subprocessors
We work with few vendors, all under contract and a duty of confidentiality. Here is each one by what it does and where; the name of each is available on request through our privacy contact.
| What it does | Region & safeguards |
|---|---|
| Database and authentication | U.S. (primary storage) |
| Application hosting | Global (edge) / U.S. |
| AI processing of decision-support requests | U.S., with identifiers removed |
| Speech transcription (dictation, recorded visits, talking to CHIRON) and CHIRON's voice, without keeping the audio | U.S., zero retention |
| Messaging with patients on WhatsApp, when enabled | Global |
| Text messages with patients in the U.S., when enabled (turned on only with a signed HIPAA business associate agreement) | U.S. |
| Platform e-mail to clinic staff, when enabled | U.S. |
| Clinic subscription payments (no patient data) | U.S. |
| Product usage analytics for clinics, sent from our servers, with no patient data | U.S. |
| Sign in with Google (name and e-mail) and, in Chrome, the browser's own speech recognition | Global |
Ongoing practices
- Security review on every data schema change
- Integrity gate in CI (no orphan tables or phantom flows)
- Least privilege internally as well
- Automatic backups with tested restores
- Dependency scanning with prioritized fixes
- Incident response plan with communication within 72h
Want the legal details?
The Privacy Policy describes legal bases, roles and rights. The Privacy Center shows how to exercise them. And our DPO actually answers.