Privacy Policy
Last updated: October 2026
How patient data is handled
When a clinician submits a patient assessment through NephroSense AI, the structured biomarker inputs and the resulting risk score are persisted in our backend database so the clinician can revisit results, download reports, and so we can maintain an audit trail of clinical decision support activity. The data is encrypted at rest using AES-256 with customer-managed keys held in AWS Key Management Service, plus an application-level envelope-encryption layer for the most sensitive fields, and in transit using TLS 1.2 or higher. Direct identifiers (patient name, MRN, contact details) are stripped before any model inference runs.
Where data lives
NephroSense AI runs on Amazon Web Services in the United States, using services covered by the AWS Business Associate Addendum. The application database, encryption keys, and audit logs are hosted within a private network; application components have no direct inbound internet exposure, and public traffic terminates at a load balancer behind a web application firewall. No patient data is shared with third-party analytics providers or LLM vendors that do not have a Business Associate Agreement in place with us.
Audit Logging
Every access to or modification of patient data through NephroSense AI is recorded with the authenticated clinician, the action, the resource identifier, and the time. Audit records are shipped to write-once storage retained for six years and are not exposed in clinical-facing surfaces.
HIPAA Considerations
NephroSense AI is a Clinical Decision Support tool designed for use by licensed healthcare professionals under physician oversight. We treat the data we process as Protected Health Information and will execute a Business Associate Agreement with the contracting covered entity before processing, defining permitted uses, disclosures, and safeguards. Responsibility for patient-facing consent and the underlying treatment relationship rests with the healthcare institution and treating physician.
Third-Party Services
NephroSense AI may integrate with Electronic Health Record (EHR) systems via FHIR R4. EHR data exchange is governed by the data sharing agreements between the healthcare institution and NephroSense AI. Where the application uses external AI services (for example, large language model narrative generation), only Business-Associate-Agreement-covered providers are used.
Contact Information
For privacy inquiries, contact the NephroSense AI team at nephrosenseai.com/contact. The controls behind these practices are described on the Trust & Security page.
Updates
This privacy policy may be updated periodically. Material changes will be communicated through the website.