Security & Privacy

Demo Environment Isolation

The public demo available on this website operates in complete isolation from any production or institutional data:

Demo Characteristics

• Fictional Content Only: The demo uses non-production, fictional clinical protocol content created specifically for demonstration purposes.

• No Real Patient Data: No real patient information, real institutional protocols, or sensitive medical data is used in the demo environment.

• Separate Infrastructure: Demo infrastructure is isolated from any institutional deployment environments.

• No Authentication Required: The public demo does not collect user credentials or personal information.

Production Security Design

For institutional deployments, MediAssist is being designed with the following security principles:

Authentication & Authorization

• Independent Identity Provider: Auth0 handles authentication, keeping identity management independent of cloud infrastructure providers.

• Role-Based Access Control (In Development): Different permission levels for administrators, clinicians, and other user roles.

• Institutional Boundaries: Protocol libraries are scoped to specific institutions with no cross-institutional data access.

Data Security

• Encrypted Storage: Protocol documents and embeddings stored with encryption at rest.

• Secure Transmission: All data transmitted over HTTPS/TLS.

• Access Logging: User queries and protocol access logged for audit purposes.

• Private Document Storage: Protocol documents uploaded by institutions remain private to that institution.

API Security

• Authentication Required: API endpoints require valid authentication tokens.

• Rate Limiting: Request rate limits to prevent abuse.

• Input Validation: All user inputs validated and sanitized.

Source Traceability

A core security feature of MediAssist is that every answer includes complete source citations. This allows healthcare professionals to verify information and trace it back to authoritative protocol documents, reducing the risk of acting on incorrect or hallucinated information.

What MediAssist Is NOT

To be completely transparent about the current state of the product:

• Not HIPAA Compliant: The platform has not undergone HIPAA compliance certification.

• Not SOC 2 Certified: SOC 2 audit and certification has not been completed.

• Not ISO 27001 Certified: ISO information security certification has not been obtained.

• Not Approved for Clinical Use: MediAssist has not been reviewed or approved by medical regulatory authorities.

• Not a Medical Device: The platform is a knowledge access tool, not a medical device as defined by regulatory agencies.

Roadmap

As MediAssist moves toward production deployment, we will pursue appropriate security certifications and compliance frameworks based on institutional requirements and regulatory guidance.