A bounded approach to sensitive workflows

Start without patient data

Discovery, public demonstrations, and the representative case study use synthetic information. Do not submit protected health information through the website form or ordinary introductory email.

Data minimization and purpose limitation

• Limit inputs to the fields and documents required for the agreed workflow.
• Define permitted uses before access.
• Separate evaluation data from unrelated customer systems where practical.

Deployment options

Depending on scope, the workflow can be evaluated in a controlled KamiBridge environment or designed for a customer-controlled environment. Hosting, network access, integrations, subprocessors, and operational ownership are documented before production use.

Access and human review

• Use role-appropriate access and protect administrative functions.
• Keep material outputs linked to source evidence and available for qualified review.
• Require human approval for coding, documentation, or claim-impacting decisions.

Retention and deletion

For any approved evaluation, retention periods, deletion steps, backups, and end-of-engagement handling are agreed in writing. The preferred default is the shortest period that supports the evaluation and its documented findings.

Validation and incident responsibilities

Acceptance criteria, failure cases, monitoring expectations, escalation paths, and incident responsibilities are defined for the specific workflow. No public page or pilot proposal should be interpreted as a guarantee of regulatory compliance.

Current assurance status

KamiBridge does not claim SOC 2, ISO 27001, HIPAA certification, or another independent assurance unless a current report or certificate is provided separately. Contractual and regulatory requirements are assessed for each deployment.

Security contact

For security or data-handling questions, contact doudou@kamibridge.com. Do not include patient data or credentials in the initial message.