Trust
Evidence you can inspect.
Data you can account for.
We are asking care teams, health plans, and partners to rely on what our software surfaces. That only works if the basis for every output is visible, the limits are stated, and patient data is handled with care. This page sets out how we do that, including what is still in progress.
Updated as our licensing, agreements, and assessments progress.
01 / Evidence sources
Every answer
carries its sources.
Where guideline answers, compliance reports, and trial assessments come from, and how citations are attached.
- NCCN Clinical Practice Guidelines
- Guideline answers and compliance reports are grounded in the guideline text itself, not a summary. Each answer cites the specific section, version, and category of evidence that supports it. If the guideline does not address a question clearly, the answer says so. Commercial use of NCCN content requires a formal agreement with NCCN; verifying that license is on our pre-production checklist, and we will not deploy commercially until it is confirmed.
- Drug compendia and clinical algorithms
- Guideline answers draw on drug compendia and the clinical algorithms that accompany the guidelines, so a recommendation can be traced to the regimen and the setting it applies to.
- Health plan drug policies
- Drug policy checks read the plan's own policy document and extract its general requirements, specific indications, and exclusions. No pre-built template is substituted for the policy as written.
- Trial registries and partner networks
- Trial matching screens trials from partner networks and returns a criterion-by-criterion assessment: met, unmet, or uncertain, each with its rationale, so the open questions are visible to the care team.
02 / How AI is used and reviewed
Software prepares.
People decide.
Parts of the platform use machine learning to read documents and draft structured output. Here is the division of labor, plainly.
- What the software does
- It reads clinical documentation, extracts the structured facts a review needs (diagnosis, staging, biomarkers, line of therapy, treatment history), drafts guideline answers and reports, and assembles trial eligibility assessments.
- How extractions are checked
- For compliance work, a second independent pass checks each extraction before a report is produced, and the same input always produces the same output.
- What people do
- Clinicians and their teams review every answer, report, and assessment. The software supports clinical judgment; it does not replace it. Where the evidence is unclear or information is missing, the output says so rather than guessing.
- What we do not do with your data
- We do not use clinical data to train models, ours or anyone else's. Clinical data is used only to provide the service to the practice that owns it.
03 / Data protection
Built for protected
health information.
What is in place today, and what remains on the pre-production checklist.
- HIPAA
- The platform is architected with HIPAA requirements as a first-order design constraint: practice-level data isolation, role-based access control, encryption, and audit logging are built in. Full compliance also requires signed agreements with every vendor that handles protected health information, formal security policies, breach notification procedures, and a completed risk assessment. We will not represent the platform as HIPAA compliant until that process is complete.
- Business associate agreements
- Verifying and documenting business associate agreements with every third-party service in the protected-health-information processing chain is a pre-production requirement. That verification is in progress and not yet complete. We will not process real patient data in production until it is.
- Data isolation and access
- Every patient record is scoped to a practice at the database level. Access is controlled by role (system admin, practice admin, provider, nurse, front desk, billing, and patient portal) and enforced at the interface level. ClinixBoost staff do not have access to patient records in any production environment.
- Encryption
- All external communication uses HTTPS and TLS. Databases and cloud storage are encrypted at rest. Real-time messages between care team members are encrypted.
- Audit logging
- All data access and changes are logged with user identity and timestamp. Access logs are maintained for every record view and change.
- Retention
- Voice recordings used for dictation are processed in real time and are not stored beyond the active session. Transcripts, notes, and reports are stored encrypted and scoped to the practice that created them. We do not sell, share, or monetize patient data in any form.
04 / What we don't claim
Clear about
the limits.
- 01A substitute for clinical judgment. Qualified care teams review and decide.
- 02A guarantee of coverage approval. Reports make the basis for a request visible; the decision belongs to the reviewer.
- 03Exact costs. Any cost or coverage estimate depends on patient-specific information and plan terms.
- 04Availability of everything on this site. Items labelled as our vision are a direction of development, not features available today.
- 05Independent certifications we have not completed. We state the status of licensing, agreements, and assessments as it is.
Current capability is available today. Our vision is our direction of development.
A shared ambition
Trust is earned
one visible decision at a time.
For practices, health plans, and technology partners who want to see the basis for every output before they rely on it.