Security

What we do with your patient's story, from the tablet to the deletion. Checked against our code on 12 November 2026. No outside penetration test has been done yet.

On the way

• HTTPS only, on the site and on the API, with HSTS.
• A strict Content-Security-Policy: scripts come from our own site only, no inline script, no framing.
• The AI's answers and the patient's words appear as text. The page never runs them as code.
• A clinic tablet holds a signed token for 2 hours, tied to one work code. Rate limits apply per token, per connection and per work code.
• A clinic tablet is paired once from the doctor's page with a code that works one time for 10 minutes. The doctor sees the paired tablets and can remove one at any time.
• The instructions given to the AI are written on our server. The page sends the patient's answers and the name of the step, nothing else.
• We removed Cloudflare Turnstile on 3 November 2026. The tablet tokens and the rate limits stop abuse instead.

Sign-in

• You sign in with a six-digit code we email you. It expires in 10 minutes; we keep only its hash. Too many wrong guesses lock the address for a while.
• A session lasts 30 days, gets a new token every 24 hours, and ends when you sign out.
• Our admin tools need a token and a time code from an authenticator app, and we log every admin action.

Stored

• We write no patient text to logs, error messages or our key-value store. Our tests check it on every run.
• Each case is one object in your region's private AWS bucket, encrypted at rest, readable only through your session.
• The bucket deletes every case 30 days after the visit. You can delete a case sooner: open it, then Delete this case.
• We never store, email or count the public demo.

The AI

• In production the AI is AWS Bedrock, model Claude Haiku 5.5, pinned: no fallback to another provider. We checked the live server on 6 November 2026.
• Amazon Bedrock does not store or log prompts and answers and does not train on them. Bedrock is covered by the AWS Business Associate Addendum.
• Each region calls Bedrock through its own relay, which logs nothing. Canada stays in Canada, the United States in the United States, the UK, EU and Gulf in the European Union, Australia in Australia. The Philippines, India and Brazil use AWS's global profile, which can run in any AWS commercial region.
• Every request crosses Cloudflare's network first. The API runs in memory at the Cloudflare data center nearest the caller, which can sit outside your country, and stores nothing there.

Licence photos

If you verify with a photo of your licence, we encrypt it, read the licence number and the name once, and delete it the moment we record a decision, within 7 days at most. We keep the licence number, the register's answer, the decision and the date.

If something goes wrong

1. Carlos Faviel Font, our privacy officer, hears about it at once: info@instanthpi.com.
2. The same day he contains it: new secrets, every session ended, the route offline if needed.
3. Within 72 hours of confirming it, he tells each affected doctor what data, which dates, what we did and what you should do. You decide what to tell your patients.
4. Where the law requires it, he notifies the regulator: the Commission d'accès à l'information in Quebec, the Privacy Commissioner of Canada, US HHS, an EU or UK authority within 72 hours.
5. Each incident goes into our incident register with its dates and actions.

To delete one case: open it and click Delete this case. To close your account and its data: write to info@instanthpi.com from your account's email.

Quebec Law 25

• You choose your data region. With Canada, your cases stay in AWS Montreal (ca-central-1), and the AI runs on Bedrock's Canada profile, in Canada, sometimes in Calgary.
• What leaves Quebec: the AI text when Bedrock uses Calgary, and every request in transit through Cloudflare. The sign-in email goes through AWS SES in the United States with your email address only. We never email your cases.
• Privacy officer: Carlos Faviel Font, info@instanthpi.com.
• Still to do: our privacy impact assessment for the transfers outside Quebec.