Trust
Security overview
Last reviewed: 1 October 2026 · Applies to the Neurovane clinical platform. Full questionnaire and DPA schedule under NDA.
1. Data flow, in order
- Ingest. A study arrives from the clinic's PACS/EMR or a technician upload, over TLS, into a per-clinic tenant.
- De-identification. Direct identifiers (name, MRN, dates beyond year, face and burned-in annotation) are removed by the ingest pipeline before the package is readable by any downstream service.
- Processing. Only the de-identified package and derived features reach language or drafting features. Identifiers are not queued, cached or logged alongside them.
- Return. The signed report is written back to the clinic's record system and the working copy is expired per the retention schedule.
2. Access control
- Named accounts only — no shared logins, no generic clinical accounts.
- Role separation: technician, reading physician, coordinator, administrator. A coordinator cannot open a study they are not assigned to.
- Tenant isolation: a workspace belongs to exactly one clinic. Cross-tenant reads are blocked at the query layer, not by convention.
- SSO available per clinic; MFA enforced on all administrative accounts.
3. Logging
Every study open, export, annotation change and permission change is logged with actor, timestamp and object. Logs are append-only, retained 12 months, and are available to clinic administrators on request.
4. Subprocessors
| Processor | Purpose | Data |
|---|---|---|
| Cloudflare | Edge delivery, DNS, email routing | Request metadata |
| Amazon Web Services | Primary compute and storage (Singapore) | De-identified study packages |
| Business email & docs | Internal correspondence, contracts | Staff and contact records |
The current signed schedule, with regions and DPAs, is attached to each clinic agreement and updated 30 days before any change.
5. Retention & deletion
Working copies expire per clinic configuration (default 30 days after report sign-off). On termination, identifiable data is deleted within 30 days and a deletion certificate is issued. Backups roll off within 35 days.
6. Model usage
No patient data is used to train, fine-tune or evaluate any model. Drafting features receive de-identified text only. Clinic content is never used to build cross-clinic datasets, and no clinic's content is visible to another clinic.
7. Incident response
Suspected incidents are triaged within 24 hours. Confirmed incidents affecting clinic data are notified to the clinic's named contact within 72 hours, with scope, containment and remediation steps. We run a tabletop exercise twice a year.
8. Contact
Security questionnaire, pen-test summary and DPA template: support@neurovane.com