Skip to main content

Privacy and trust

Clinical Corvus is designed to keep identifiable patient context inside the backend boundary by default. This behavior depends on technical controls and correct environment configuration. It is not, by itself, a compliance certification.

Third-party sharing​

The backend uses ALLOW_THIRD_PARTY_DATA_SHARING to control data sent to remote services. The default disables third-party PHI sharing.

There is a bounded exception: queries marked as public and without PHI indicators may use approved external providers. The policy blocks that fallback when the query is not public or contains patterns that may indicate PHI.

When canonical clinical research uses external sources, it builds a redacted query intended to remove PHI. This protection must be verified for every path that calls an external provider. The presence of a sanitizer does not prove automatic coverage across the entire system.

Tenant and access​

Clinical data is associated with tenant_id. Covered PostgreSQL tables receive Row-Level Security policies through the tenant-scoping migration. Services also apply tenant context during operations.

The exact table, role, and administrative-path coverage must be confirmed during deployment review.

State and memory​

Clinical Corvus separates longitudinal patient context, current episode state, conversation working memory, and learned user preferences. Retention, deletion, and storage depend on enabled services and local operational policies.

Providers and BYOK​

Tenants can configure providers when the feature is enabled. A tenant-owned key does not guarantee that data remains within institutional infrastructure. The selected endpoint, provider contract, and backend policy determine the actual boundary.

What to verify before a pilot​

Review external provider paths, tenant and RLS coverage, retention for documents and telemetry, authorized roles, incident response, kill-switch operation, contracts, legal bases, and local compliance requirements.

Also read the Current product boundary and Validation and beta status.