SECURITY & PRIVACY

Security and privacy in the validation prototype

The validation prototype focuses on non-clinical operational workflows and does not require patient health information. Production deployments would require a separate security, privacy and compliance review. We do not currently hold HIPAA, SOC 2 or other certifications.

Current prototype

• The demo uses a fictional organization and fictional operational data.
• It does not require, request or store patient health information.
• Its purpose is to validate non-clinical workflows with real teams.
• The knowledge assistant in the demo is scripted; it is not a live AI service.

Data minimization

We collect and expose only what a workflow needs. The workflow review form asks for five fields: name, work email, organization, role and primary challenge. Submissions are stored on the server, are not publicly readable, and are not sent to analytics. Analytics events record which options are chosen, never names, emails or written answers.

AI

AI-assisted outputs are first drafts and require human review before external use. The separate live Workflow Adviser sends your non-sensitive workflow descriptions to Lovable AI and saves the conversation privately to your signed-in account. It does not access your organization’s systems or documents. You can clear your saved conversation in the adviser. Do not enter patient, personal or confidential information. Basic input checks are not a guarantee that sensitive information will be detected.

Production deployments

Organizations that need regulated-data processing would require separate:

• Infrastructure review
• Access-control design
• Vendor review
• Security assessment
• Compliance evaluation
• Contractual review