Behavioral Text
Captures the session as it is spoken, labeled by voice, gentle with silences and ready the moment you say goodbye.
Recording starts only after documented consent.
Meet this agentCompliance & patient safety
Trust, engineered in.
Not bolted on.
HIPAA, SOC 2 Type II and Cyber Essentials Plus are the floor, not the ceiling. The clinician stays in control, crisis indicators reach a licensed human, and every agent decision is auditable, end to end.
Risk Detection Agent
Ethics & privacy
Privacy by design.
Six commitments govern every model we train, every feature we ship, and every patient interaction the platform touches.
PHI minimization
We collect the minimum PHI the clinical task needs. Identifiable PHI never trains a model, and customer data never trains a general-purpose one, ours or a vendor's.
Fairness on a cadence
Bias is evaluated on a regular cadence across demographic groups, and drift is investigated before it reaches a clinician's screen.
Reasoning you can read
Every recommendation cites the source utterance, chart finding or policy clause behind it. The clinician sees the evidence, not a black box.
Clinician always in control
The platform drafts, suggests and proposes. A licensed clinician reviews and signs every care-impacting decision before it reaches a patient.
Patients retain the pen
Patients can review what was captured about them, request correction, and opt out of algorithmic decision-making at any time.
Training data provenance
Training data is sourced, documented and reviewed. An anonymous concern channel lets clinicians flag model behavior they don't trust.
Compliance posture
The frameworks your
compliance team asks for.
Built to the standards healthcare compliance teams require, with controls monitored continuously rather than refreshed once a year. Request the evidence behind any of them.
SOC 2 Type II
Independently audited against all five Trust Services Criteria, over a continuous observation period.
Request the SOC 2 Type II report
HIPAA
Administrative, physical and technical safeguards, with a Business Associate Agreement executed before any PHI moves.
Request the HIPAA Security Rule mapping and BAA
Cyber Essentials Plus
The UK government-backed scheme at its Plus level, verified hands-on by an external assessor.
Request the Cyber Essentials Plus certificate
GDPR
A Data Processing Agreement with standard contractual clauses, and EU data-residency options.
Request the Data Processing AgreementEnterprise-grade
Privacy at
every layer.
Encryption, tokenization and access controls protect patient data from session to sign-off.
Encrypted end to end
TLS 1.3 in transit with forward secrecy, and AES-256-GCM for all data at rest.
Managed keys
HSM-backed key management with automated 90-day key rotation.
PHI tokenization
PHI is tokenized at the application layer before storage, and de-identification pipelines meet HIPAA Safe Harbor standards.
Data residency
Primary processing and storage in United States regions, with EU data-residency options for European deployments.
Zero-trust by default
Least-privilege roles, MFA for every user and just-in-time administrative access. Identity is verified at every layer.
Auditable end to end
Every agent action and every PHI access is logged with its evidence and its approver, and retained for at least six years.
Every
care-impacting output signed by a licensed clinician
Never
customer PHI used to train a foundation model
6 years
minimum audit log retention, as HIPAA requires
Patient safety
Clinician always
in control.
The platform drafts and proposes. A licensed clinician reviews and signs. Crisis indicators escalate to a licensed human with a warm handoff, never to an automated reply.
Care Orchestrator
Clinician sign-off, always
Every care-impacting output is reviewed by a licensed clinician before it reaches a patient. Model updates require clinical sign-off before they reach the visit.
Risk Detection Agent
Crisis escalation
Indicators of self-harm, suicidal ideation or acute distress trigger immediate escalation to a licensed clinician, with warm handoff protocols, never an automated reply.
Glass In
Guardrails before the chart
Hard guardrails sit between the agents and the record. Only signed work is filed, the platform never overrides a clinician, and when in doubt it escalates to one.
Narrow jobs, clear limits
Every agent knows
where it stops.
Each agent owns a narrow, auditable job and cannot act outside it. What it does, and what stays with you, is written on every card.
Clinical Q&A Agent
Answers questions mid-session, grounded in good practice and in this client's own history.
Every answer is cited to a chart line or a source.
Meet this agent
Session Cues Agent
Offers gentle observations at the edge of your screen, and suggests the right check-in when the moment fits.
Every cue is an offering, never a conclusion.
Meet this agent
Follow-up Agent
Tracks referrals, missed visits and check-ins to completion, so nobody falls through the cracks.
You set who gets a nudge.
Meet this agentFor your compliance teamSend this page to
Send this page to
your compliance team.
Everything a security review asks for, in one packet. It is shared with customers and with prospects in an active evaluation, under NDA where required.
In the security packet
- SOC 2 Type II report
- Cyber Essentials Plus certificate
- HIPAA Security Rule mapping
- Named subprocessor list
- Architecture overview
- Most recent penetration test summary
FAQ
What reviewers ask first.
Still wondering about something?
A real person will answer, usually the same day.
Yes. Medera acts as a Business Associate, and every engagement begins with a signed BAA, executed before a single record moves.
Yes. The report is available to customers and to prospects in an active evaluation, under NDA. It is part of the security packet, alongside the Cyber Essentials Plus certificate and our HIPAA Security Rule mapping.
No. Customer PHI is never used to train, fine-tune or evaluate any general-purpose model, ours or a vendor's. This is contractual, not a setting.
Primary processing and storage are in United States regions. EU data-residency options are available for European deployments, and we confirm the region in writing before you contract.
Indicators of self-harm, suicidal ideation or acute distress are surfaced to a licensed clinician straight away, with your escalation protocol one tap away. Never an automated reply.
No. Medera is a clinical support tool. It is not a medical device, not a diagnostic instrument, and not a substitute for clinical judgment.
The rest of Medera
Safety runs through the product.
The same guardrails you read about here are the ones working in every session.
Watching quietly
All clear this session
Your plan, one tap away
Safety
Risk detection, escalation paths and compliance, the product pillar behind this page.
YouLive
“What does the first minute feel like?”
Maria J.Warmth returning, noted
Co-therapy
Where the guardrails live day to day: Medera in session, clinician in control.
