How your data moves, what we sign, and the four policies we run by.

Last updated 17 September 2026. This page is written for the person at a practice who has to approve a vendor. It says who we are, how data moves, what we sign, what we hold, and the four policies we run by. Ask for anything not on it: support@strategic-innovations.ai.

Who we are

Strategic Innovations AI is a small vendor. Two named operators have access to pilot data; nobody else does. We do not hold a SOC 2, HITRUST or ISO 27001 report today, and we say so rather than imply one. What we can give you now is this page, the policies in full, our risk assessment, and a record of every action on your pilot that you can verify yourself.

How data moves in a managed pilot

1. Before the first item, we sign a Business Associate Agreement with the practice, and the design brief names every data source the pilot will touch. Nothing that identifies a patient is sent to us before that.
2. The practice sends a denial and a chart excerpt by secure upload named in the design. Email is used for notifications and console links only and never carries patient data. Our operator reads the upload and stores it in the pilot's record on Cloudflare.
3. The packet is drafted by our operator with a commercial language model used under terms that exclude training on your data, then read by a person on our side before you see it.
4. Your reviewer decides in a console at a private link: approve, approve with a correction, or reject. The decision, the reviewer's name and the time go on the record.
5. Someone on your team submits to the payer the way they do today. We never hold payer-portal credentials and never automate a payer portal.

Who processes data for us

• Cloudflare: hosting and storage (the pilot record, the reviewer console and the daily off-site copy of the record), and delivery of notification emails that carry no patient data.
• Stripe: payments. We never see or store card numbers.
• A commercial language-model provider for packet drafting, under terms that exclude training on customer data. The provider is named in the design brief and in the BAA schedule.

Before the first pilot that touches patient data, we execute agreements with each processor in the data path and hand you the signed list with the brief.

What we hold, and for how long

• Pilot records (items, packets, decisions, corrections, the sealed chain): for the pilot and 90 days after it ends, then returned or destroyed as the practice instructs, in writing, within ten working days of the request.
• Free-packet requests (one de-identified denial each): 90 days.
• Account data (email, password hash, one session cookie) and purchase records: as described on the privacy page.
• In transit, everything is TLS. At rest, Cloudflare encrypts storage. Reviewer keys are stored only as hashes; the key itself is emailed once.
• The sealed record is copied off the database every day to separate storage, so a pilot's history survives the loss of the database itself.

Audit controls

Every pilot is an append-only chain of events. Each event's hash covers its content and the previous event, and after every event the head is signed with an Ed25519 key whose public half is published at /v1/ledger/public-key. Anyone with the export can verify it without asking us, at /v1/ledger/verify; an edited or dropped record fails with the reason. Each reviewer has a unique key per pilot, and every decision names the reviewer and the time. This is how we meet the audit-control and unique-user requirements of 45 CFR 164.312 for the record of the pilot.

The four policies

Access control

• Two named operators. Access is by individual account; no shared passwords. Secrets live in Cloudflare's secret store, never in files or chat.
• Each pilot's reviewer key opens that pilot only. The operator token creates work and cannot record a reviewer's decision.
• Access is removed within 24 hours of a role change and reviewed at every sprint review.

Incident response

• Any suspected exposure of practice data is contained first, then reported to the practice within 72 hours of discovery, with what was affected, what we did, and what we will change. This is shorter than the law requires of a business associate, on purpose.
• The incident, the timeline and the fix are written into the pilot's record.

Data handling

• Nothing that identifies a patient enters the self-serve workspace or a free-packet request; the request form requires the sender's attestation.
• Pilot data is used for that pilot only. It is not used to train models and not shown to another customer.
• Return or destruction on request, in writing, within ten working days; confirmation in writing.

Acceptable use

• The employee prepares; a person decides and a person submits. We do not automate payer portals and do not hold their credentials.
• Nothing the employee produces is medical, legal or financial advice, and nothing leaves without the practice's recorded approval.
• We may pause a pilot that is used to send unsolicited messages, to attack other systems, or to break the law.

Questions a reviewer usually asks next

• Where is the data stored? On Cloudflare's network. A storage-location constraint can be agreed in the BAA schedule.
• Can we see the policies in full and the risk assessment? Yes, by email, before you sign anything.
• Can we run the verifier ourselves? Yes; the command is on the worked example.