How Tabflows handles patient data

---

AI is where most teams have the hardest questions. Here are the plain answers.

Your PHI is not used to train shared AI models

Tabflows does not use customer PHI to train generalized or cross-customer AI models.

---

What "we don't train shared AI models on your PHI" actually means

Your data is used to run the service for your clinic: answer your prompt, pull the right chart context, draft the message in front of you. That is the service running. It does not become training data for a generalized or cross-customer AI model.

---

AI providers work under signed BAAs

When a Tabflows feature needs an AI provider working on Tabflows' behalf, including OpenAI and Google, your PHI reaches them under a Business Associate Agreement that governs how they may use and safeguard it.

A current subprocessor list is available on request from security@tabflows.com.

---

AI conversations that hold PHI are treated as PHI

Your prompts, your Sidekick chat history, and the drafts and summaries Tabflows produces are treated as PHI when they contain or are derived from PHI, and are handled under the same safeguards program as the rest of your data.

See 👉 How Tabflows protects your data.

---

You stay in control

Some Sidekick and Magic Button features prepare a draft for a person to review, edit, and send. Other documented actions can create or change information when the permitted workflow is started. Follow the specific action's review or approval steps, and verify consequential results in the source system.

---

Your clinic owns its data

The patient data in your Tabflows account belongs to your organization.

---