How We Protect Your Data
SciEncephalon AI builds AI software for healthcare and driver safety. Our clinical products cover readmission risk, length of stay, and emergency department triage. Our driver monitoring product is in development.
This page is for the security, privacy, and procurement teams who review our products. It covers how we handle data, control access, encrypt, protect privacy, approach compliance, and build AI responsibly.
Runs in your environment: Our products are installed in your cloud tenant or on premises. We do not host or store your production data. You keep control of your network, identity, monitoring, and compliance.
What We Commit To
Secure by Default
Access controls, encryption in transit, and audit logging ship with each product. They are not add-ons.
Your Data Stays Yours
You own your data. We do not use it to train or benchmark models without your written permission.
Responsible AI
Our products support human decisions. We document what each one is for and where its limits are.
Privacy
We collect the minimum personal information we need. We do not sell personal data.
How We Build and Support Our Products
- Products install in your environment and connect to the systems you already use.
- A written customer agreement covers how each product processes your data.
- Our staff have no access to your environment unless you grant it for support. That access is limited and logged.
- Every code change is reviewed and tested before release.
- We take part in responsible AI groups, including NCQA's AI Stakeholder Working Group and the AGNTCY Community under the Linux Foundation.
Product Security
Security is part of how each product is designed. Our products work with the security tools and policies you already have.
Deployment Model
Our products run in your environment. That can be on premises, in your own cloud tenant, or a hybrid of both. This means:
- You control the infrastructure.
- Network rules, firewalls, and segmentation follow your policies.
- You control identity and access.
- Sign-in, multi-factor authentication, and user roles are managed through your identity provider.
- You control the data.
- You set encryption, backup, retention, and data residency.
- You control monitoring.
- Audit logs and security events go to your monitoring tools.
We do not host your production data. It stays under your security controls and your residency rules at all times.
Security at a Glance
Security Practices
These practices apply to every product we ship.
Identity & Access
- Role-based access
- Each user role sees only what it needs.
- Multi-factor authentication
- Supported for all users. Required for admin access.
- Single sign-on
- Works with identity providers that support SAML 2.0 or OpenID Connect.
- Account provisioning
- Accounts are added and removed through your own identity processes.
- Admin access
- Logged and reviewed regularly.
Encryption
- Data in transit is encrypted with TLS 1.2 or higher.
- Data at rest is encrypted using the encryption settings of your cloud or storage.
- Encryption keys stay under your key management policies.
- Secrets and credentials are never stored in plain text.
Network
- Products run inside your network boundaries, including private networks and private endpoints.
- Products do not send data to SciEncephalon systems unless you agree to it in writing.
- Network access follows least privilege.
Logging & Audit
- Product activity and API calls are logged.
- Logs can be sent to your SIEM or monitoring platform.
- Log retention follows your policies.
APIs
- Every API call requires authentication, such as OAuth 2.0 or an API key.
- Each endpoint exposes only the operations it needs.
- Inputs are validated, and error messages do not expose sensitive data.
- API access is logged.
Secure Development
- Code review
- Required for every change before release.
- Dependency scanning
- Automated checks flag known vulnerable packages.
- Vulnerability monitoring
- Ongoing across our products and their dependencies.
- Release approval
- Each release is tested in staging and approved before it ships.
- Security in design
- Security requirements are set when a feature is designed, not after it is built.
Integrations
Our products work with common enterprise tools:
- Single sign-on (SAML 2.0, OpenID Connect)
- Multi-factor authentication
- SIEM platforms
- Cloud monitoring services
- REST APIs
- AWS, Azure, and GCP
- Private networks and endpoints
- On-premises servers
Vendors & Subcontractors
Before a vendor or subcontractor can touch customer data, we review them and bind them to confidentiality terms. Their access is limited to what the task needs.
Our People
- Confidentiality agreements
- Employees and contractors sign confidentiality agreements before they start.
- Background checks
- Staff who may access customer data are background checked.
- Security training
- Staff complete training on data handling, phishing, access control, and secure coding.
- Offboarding
- Access is removed promptly when someone changes roles or leaves.
Incident Response
We have a process to find, contain, and fix security incidents that affect our products or our customers.
- Detect: We find incidents through monitoring, customer reports, or responsible disclosure, and assess their scope and severity.
- Contain: We isolate affected systems to stop further exposure.
- Notify: We tell affected customers promptly, within the time required by law or contract. We share what happened, what was affected, and what we did.
- Fix: We find the root cause and fix it.
- Review: We review each incident and improve our controls.
To report a suspected security incident, email contact@sciencephalon.com. We treat every report as confidential.
How Our Products Handle Your Data
You own your data. Our products process it only to do what you licensed them to do.
Ownership
- Your data belongs to you.
- We claim no rights to your data beyond what we need to provide and support the product.
- Your data stays where you deploy the product. We do not move it out of your environment without your written permission.
- When a contract ends, we return or delete any of your data we hold, as you direct.
Data Principles
- Purpose limitation
- Your data is used only for the product's stated purpose.
- Data minimization
- Each product uses only the data it needs.
- Limited access
- Our staff see your data only when you grant support access, and only what the task needs.
- Written terms
- Data processing is covered by our customer agreements.
- No secondary use
- We do not use your data for anything else without your permission.
AI model training: We do not use your data to train, fine-tune, improve, or benchmark AI models unless you give us written permission. This applies to every customer.
Support Access
- By default, our staff have no access to your environment.
- If you grant support access, it follows your roles and identity rules.
- Access ends when the support task is done, or sooner if you ask.
- Anyone with access is bound by confidentiality terms.
What You Control
Because our products run in your environment, you control:
- Infrastructure security settings
- Identity and access management
- Encryption standards and keys
- Network security policies
- Backup and recovery
- Data retention
- Audit logging and SIEM
- Compliance monitoring and reporting
Privacy Principles
How we handle data follows the principles of major data protection laws:
Responsible AI
Our products support the people who make clinical and safety decisions. They do not make those decisions on their own.
We are a founding member of NCQA's AI Stakeholder Working Group and a member of the AGNTCY Community under the Linux Foundation. Both groups work on standards for responsible AI.
Transparency
We tell customers what each product is for, what data it needs, and where its limits are.
Human Oversight
A person reviews and acts on every output. Our products inform decisions. People stay accountable for them.
Testing & Monitoring
Models are tested before release and monitored after. We check for drift, bias, and reliability over time.
Accountability
Each product has a named owner on our team. Customers know who to contact about how it behaves.
By Product Area
Clinical Products
Readmission risk, length of stay, and emergency department triage. Built to support clinicians and hospital operations staff, not to replace their judgment.
Driver Monitoring
In development and not yet in vehicles. Built to support driver safety programs for OEMs and fleets.
AI Governance
- NCQA AI Stakeholder Working Group
- Founding member. The group works on responsible AI governance standards for healthcare.
- AGNTCY Community (Linux Foundation)
- Member. The community works on open standards for AI agents.
- NIST AI Risk Management Framework
- We use the NIST AI RMF as our reference for how we govern, map, measure, and manage AI risk.
Privacy Statement
SciEncephalon AI is a tradestyle of SciEncephalon Corp. This statement explains how we collect, use, share, and protect personal information when you visit our website, contact us, or use our products.
Information We Collect
We collect only the personal information we need to run our business and talk with customers and partners. This may include:
- Name and job title
- Business email address and phone number
- Company name
- Information you send through contact forms or product inquiries
- Records of our business communications
We do not knowingly collect sensitive personal information, such as health information, financial account data, or government identifiers, unless a customer agreement requires it.
How We Use Personal Information
- Providing and supporting our products
- Answering inquiries and customer messages
- Managing relationships with customers and partners
- Improving our website and products
- Keeping our systems secure and preventing fraud
- Meeting our legal obligations
Sharing Personal Information
We do not sell personal information to anyone.
We share it only when we need to:
- With vendors that support our operations, under confidentiality terms
- With partners who help us support a customer, with that customer's permission
- When the law requires it
- To protect the security, rights, or safety of SciEncephalon AI, our customers, or the public
Customer Data & AI Training
We process customer data only as our customer agreements and data protection laws allow.
We do not use customer data to train, improve, or benchmark AI models unless the customer gives us written permission. This applies to every customer.
Data Security
- Administrative, technical, and physical safeguards suited to the information
- Access limited to people who need it for their work
- Encryption of sensitive communications in transit
- Ongoing security monitoring
Data Retention
We keep personal information only as long as we need it for the purposes above, or as long as the law or a contract requires. When we no longer need it, we will delete or anonymize it on request where the law allows.
Your Privacy Rights
Depending on where you live, you may have these rights:
| Right | Description |
|---|---|
| Access | Get a copy of the personal information we hold about you. |
| Correction | Fix personal information that is wrong or incomplete. |
| Deletion | Have your personal information deleted where the law allows. |
| Restriction | Limit how we process your personal information. |
| Portability | Get your personal data in a structured, portable format. |
| Objection | Object to certain kinds of processing. |
To use any of these rights, email contact@sciencephalon.com.
California Privacy Rights (CCPA)
California residents can ask what personal information we have collected about them and ask us to delete it. We do not sell personal information. We do not treat anyone differently for using their CCPA rights.
GDPR (EEA Residents)
If you are in the European Economic Area, we process your personal data based on legitimate business interests, a contract, or your consent where required. You can access, correct, erase, and port your data, and you can complain to a supervisory authority. Email contact@sciencephalon.com for any GDPR request.
International Data Transfers
We operate in the United States, so personal information about our business relationships may be processed there. Where required, we use appropriate safeguards for international transfers.
Changes to This Statement
We may update this statement when our practices or the law change. We will post each new version here with a new effective date.
Compliance
Our products are built to fit the compliance programs our customers already run. Because the products run in your environment, you keep control of your own compliance.
We are a software vendor. We support your compliance program with documentation and product controls. We are not a certified compliance provider.
Frameworks We Align With
How We Support Your Review
- We consider compliance requirements when we design each product.
- We can share security documentation and data flow summaries under NDA for your audit and risk reviews.
- Our customer agreements set out roles and obligations for data processing.
- Because products run in your environment, you control monitoring, reporting, and audit logs.
- We work with your legal, compliance, and security teams during review.
By Product Area
Clinical Products
Designed to run in HIPAA-regulated environments. Our AI governance draws on our work with NCQA. A person reviews every output.
Driver Monitoring
In development and not yet offered to customers. We will add its safety and compliance details here before it is.
Note: We do not hold SOC 2 Type II or ISO 27001 certification today. For vendor security reviews, we provide documentation, contract commitments, and answers to your security questionnaire. Email contact@sciencephalon.com.
Security & Privacy Contact
Contact us for security questions, privacy requests, responsible AI questions, or help with a vendor review. We keep every inquiry confidential.
SciEncephalon AI
Security · Privacy · Responsible AI · Vendor Review
We respond to every security and privacy inquiry promptly.
What We Can Help With
- Vendor security reviews
- Security documentation, practice summaries, and contract commitments for your vendor risk process.
- Privacy requests
- Requests to access, correct, delete, or object to the use of personal information we hold.
- Product data questions
- How our products handle, process, and protect your data.
- Responsible AI questions
- Our AI governance, model use policies, and how we test each product.
- Compliance documentation
- Security documents to support your audit or compliance review.
Responsible Disclosure: If you find a possible security vulnerability in a SciEncephalon AI product or our website, please report it to contact@sciencephalon.com. We will investigate and fix confirmed issues. We welcome good-faith security research.
SciEncephalon AI · SciEncephalon Corp.
contact@sciencephalon.com