Identifiers come out before the model sees anything
When you upload a document, names, dates of birth, schools, phone numbers and other identifiers are found and replaced with placeholders. Only that de-identified text is ever sent to an AI model.
A separate service sits in front of the model. It refuses any request that isn’t marked as de-identified, checks again for obvious identifiers, and refuses any passage that doesn’t belong to your clinic.
- In your document
- Jordan Sample, born March 4, 2015, attends Example Public School.
- What the model receives
- [CLIENT_1], born [DOB_1], attends [SCHOOL_1].
- What you read in the reply
- Jordan Sample attends Example Public School.
De-identification is automatic, and no automatic tool catches every identifier every time. That is why the second check exists, and why the rest of this page matters too.
Each clinic’s records are kept apart
Your clinic’s records are walled off from every other clinic’s. Nobody outside your clinic can open them, and this protection is built into where the records are kept, so it doesn’t depend on the app getting it right every time.
Inside your clinic, each person’s role sets what they can do. Front-desk staff, for example, can set up cases and upload documents but can’t use the AI.
A log that can’t be edited
Anything that touches client information is recorded, with who did it and when. Entries can be added but never changed or deleted, and the clinic owner can read the log.
- Viewing a case or a document
- Uploading a document
- Asking the AI a question
- Exporting
- Signing off
- Adding, changing or removing a member
Where your data goes
| What | Where it is stored |
|---|---|
| The app, its database and your uploaded files | CanadaAWS, Canada (Central) region. |
| The search index of your documents | CanadaBuilt from de-identified text by a model that runs in the same region. |
Your files, the database and the search index are all stored in Canada. The only thing that goes to the AI model is de-identified text, which the models we use today may process in data centres in the United States. It is never used for training. Our privacy review covers this arrangement, and we share it with any clinic that asks.
Never used to train AI models
We don’t train models on anything your clinic uploads or types, and we don’t let anyone else do it either.
The models run on Amazon Bedrock. AWS states that Bedrock does not use prompts or replies to train models and does not share them with the model providers.
Signing in
Members sign in with a passkey, or with a password and a second step from an authenticator app. Sessions end after a period of inactivity.
What our own logs hold
The system’s technical logs record identifiers, counts and timings. They never record prompts, documents, names or model replies.
Your clinic stays in control
Your clinic remains the custodian of its clients’ health information. We act as your service provider, and we’ll give you what you need to assess the tool, including our privacy review.
Who to contact
For privacy questions and requests for access to information, write to privacy@clinicaiworkspace.com.
To report a security issue, write to security@clinicaiworkspace.com.