Built for healthcare from day one. Not bolted on later.
Solafya handles protected health information (PHI) under HIPAA. Every decision we make about how to store, transmit, and process your patients' information is made with audit, encryption, and access control as defaults, not afterthoughts.
Enterprise AI safety & governance
Built with strict clinical guardrails, no PHI used to train AI models, and evidence-backed reasoning.
Zero PHI model training
AI features run on Amazon Bedrock inside our own AWS account, under our business associate addendum with AWS. We do not use patient health information to train AI models, and we do not send it to public AI tools.
Human-in-the-loop guardrails
AI Suggests. Clinicians Decide. Writing an AI-drafted note into the EHR requires an explicit physician confirmation step. Every note is inserted as preliminary, never auto-signed, and clearly labeled as AI-generated before a physician ever sees it.
Evidence-backed citations
Every clinical summary and differential Lumina generates is cross-referenced against the patient's chart history and cites published clinical guidelines, including PubMed PMID references.
OWASP Top 10 for LLM Applications
Patient chart data is explicitly delimited from clinician instructions in every prompt, with logged detection for injection attempts and per-user rate limits bounding request volume against abuse.
HIPAA-aligned, with a BAA for every clinic
We sign a Business Associate Agreement (BAA) with every clinic before any patient data flows. You can read ours in full at solafya.com/baa.
- Our cloud infrastructure is HIPAA-eligible and covered by our own business associate addendum with AWS
- Patient names, addresses, phone numbers, dates of birth, and EHR patient IDs are encrypted with AWS KMS before they are stored, and our pipeline works with an internal Solafya ID in place of your EHR's patient ID
Your patient data is never sent to ChatGPT or other public AI tools
Solafya's AI summaries and trend insights run inside our HIPAA-aligned environment.
- Patient data is never used to train AI models
- Every AI suggestion is labeled, cited, and requires physician review before any clinical action
- AI copilot suggestions are recorded in an audit log designed for two-year retention
Your data is encrypted, always
Patient information is encrypted both while it sits in our systems and while it travels between them.
- EHR login credentials are encrypted with a clinic-unique key
- Email and text alerts never include patient names, IDs, lab values, or diagnoses; they point you to a secure sign-in
Who can see what, and when
Access to any part of the system is permission-based. Every clinical action is recorded.
- Role-based access control, enforced at the organization level
- Staff and customer access are separate, monitored identity pools
It's your data. Always.
Your clinic owns its patient data, end to end.
- We don't sell it. We don't share it with anyone outside the BAA chain
- Export on request
- Deletion on request after your pilot or subscription ends
Where we are, and where we're going
Today
HIPAA-aligned. BAA available with every pilot.
In progress
SOC 2 Type I, targeting Q4 2026.
On our radar
Additional certifications as we grow with our customers.
If something goes wrong
If a security incident affects your clinic's data, we'll tell you plainly and without unreasonable delay, and no later than our Business Associate Agreement requires (ten calendar days after we discover a breach of unsecured patient information), with what we're doing about it.