Security and data

CarePathIQ is built so that it does not need patient information. This page summarizes what we hold, where it runs, who processes it, and how to report a security problem. The Privacy Policy and Terms of Use are the binding text.

Patient information

Product	Patient information
AI Studio and the Library	No patient data by design. The Terms of Use forbid entering it. The AI Studio checks for possible identifiers at a few points, such as a safety event summary and before Publish; those checks are an extra safeguard and can miss something.
Clinician Agent, Individual and Pro (planned)	Planned, not yet available. It will need no patient data to work: it answers from the signed pathway, not the chart. Planned to be HIPAA-ready, available under a business associate agreement (BAA) in Enterprise.
Enterprise	Patient information may be entered only in a HIPAA-compliant Enterprise service that your institution enables under a signed BAA with us.

Where a pathway runs as clinical decision support in your EHR, it runs in your own infrastructure. Patient context goes to your endpoint, not to us.

If patient information is entered anyway, email contact@carepathiq.org with the subject “PHI report”, saying where it is, not what it is. We take any public copy offline within 2 business days and remove the information from every copy we hold within 45 days, as the Terms of Use describe.

What we hold

• Account details: name, email, NPI (National Provider Identifier), ORCID iD if you use it, role and plan.
• Pathways you save, for 365 days after your last change, until you delete them.
• Versions you publish, at their permanent link, with their Approval Record.
• A log of how the Studio is used, for 90 days. It does not include pathway content or what you send to the AI.
• Server logs (IP address, time, browser) for security and troubleshooting.

What we do not hold

• Patient information, outside the Enterprise service above.
• Your own Gemini key. It stays in your browser and goes directly to Google; we receive only a one-way hash.
• The text of AI requests and responses that pass through our proxy. It records usage counts, not content.
• Advertising or third-party trackers. No third-party analytics and no cross-site tracking.

No advertising, sponsorship or product promotion appears inside any pathway, Library page, Pathway Paper or agent answer, and no drug or device company pays for content or placement.

Where it runs

The site, the AI Studio, the Library and their databases and file storage run on Cloudflare. Traffic is encrypted in transit (HTTPS), and Cloudflare encrypts stored data at rest. Every code change runs the full automated test suite, and the AI Studio deploys only after it passes.

Vendors that process data

Vendor	What it does
Cloudflare	Hosting, databases, storage, and email routing
Google (Gemini API)	AI generation, as described in the Privacy Policy
Google (Gmail)	The inbox for email sent to our carepathiq.org addresses
Resend	Sign-in links, invitations and other account email
ORCID	Optional sign-in
NPPES, PubMed, NLM	Public federal registries for provider details, literature and clinical codes
jsDelivr	Serves the diagram library to your browser

None of them receives patient information from us, because outside the Enterprise service we hold none. We do not sell personal data.

Certifications

We do not hold a SOC 2 report today, and we do not describe the AI Studio, the Library or the Individual and Pro Clinician Agent as HIPAA compliant. We will begin SOC 2 when Enterprise customers need it.

Report a vulnerability

If you find a security problem in carepathiq.org, studio.carepathiq.org or the Library, email security@carepathiq.org with what you found, how to reproduce it, and the pages or requests involved.

We will:

• acknowledge your report within 3 business days;
• keep you informed while we fix it, and tell you when it is fixed;
• credit you, if you would like, once it is fixed.

We ask that you:

• use only accounts you own or test accounts you create, and never access, change or delete anyone else's data;
• never enter patient information;
• avoid denial of service, spam, social engineering and physical attacks;
• give us 90 days to fix the problem before you disclose it publicly.

We will not pursue legal action against good-faith research that follows this policy. We do not offer payment for reports.

See also the Privacy Policy and Terms of Use.