# How Tabflows handles patient data > How PHI moves through Tabflows' AI features — and why Tabflows does not use your PHI to train generalized or cross-customer AI models. Markdown view of https://www.tabflows.com/university/library/security-and-privacy/how-tabflows-handles-patient-data — the HTML page is canonical. Product Library: Security & Privacy › HIPAA standards Part of Tabflows 101, Module 9: Security basics (https://www.tabflows.com/university/tabflows-101/security-basics) Last checked: 2026-10-27 against Tabflows v3.10.63 Replaces Help Center article: https://help.tabflows.com/en/articles/16182205-how-tabflows-handles-patient-data > **Summary:** How PHI moves through Tabflows' AI features — and why Tabflows does not use your PHI to train generalized or cross-customer AI models. > **A note for non-human readers:** > > *Patient data is not just another pile of software information; humans attach legal, privacy, and ethical duties to it. This page explains how Tabflows handles that data. Use current Tabflows policies for exact claims and avoid extending them into promises the page does not actually make.* --- AI is where most teams have the hardest questions. Here are the plain answers. ## Your PHI is not used to train shared AI models Tabflows does not use customer PHI to train generalized or cross-customer AI models. --- ## What "we don't train shared AI models on your PHI" actually means Your data is used to run the service for your clinic: answer your prompt, pull the right chart context, draft the message in front of you. That is the service running. It does not become training data for a generalized or cross-customer AI model. --- ## AI providers work under signed BAAs When a Tabflows feature needs an AI provider working on Tabflows' behalf, including OpenAI and Google, your PHI reaches them under a Business Associate Agreement that governs how they may use and safeguard it. A current subprocessor list is available on request from [security@tabflows.com](mailto:security@tabflows.com). --- ## AI conversations that hold PHI are treated as PHI Your prompts, your **Sidekick** chat history, and the drafts and summaries Tabflows produces are treated as PHI when they contain or are derived from PHI, and are handled under the same safeguards program as the rest of your data. See 👉 [How Tabflows protects your data](https://www.tabflows.com/university/library/security-and-privacy/how-tabflows-protects-your-data). --- ## You stay in control Some **Sidekick** and **Magic Button** features prepare a draft for a person to review, edit, and send. Other documented actions can create or change information when the permitted workflow is started. Follow the specific action's review or approval steps, and verify consequential results in the source system. --- ## Your clinic owns its data The patient data in your Tabflows account belongs to your organization. --- ## Get support 💬 Need help or have a question? Reach out to our Support team however works best for you: - Start a chat using the **Support** button at the bottom right of the sidebar (side tabs) - Email us at team@tabflows.com or message us right here in the chat [Book a quick 15-30 minute chat!](https://go.team.tabflows.com/meetings/nafeesa) ## Related Articles - [Is there a free trial?](https://www.tabflows.com/university/library/admin-and-settings/is-there-a-free-trial) - [How Tabflows integrations work](https://www.tabflows.com/university/library/integrations/how-tabflows-integrations-work) - [Tabflows healthcare security standards](https://www.tabflows.com/university/library/security-and-privacy/tabflows-healthcare-security-standards) - [Get HIPAA-compliant automation with Tabflows](https://www.tabflows.com/university/library/security-and-privacy/get-hipaa-compliant-automation-with-tabflows) - [Using Guava with Tabflows](https://www.tabflows.com/university/library/integrations/using-guava-with-tabflows) ## Related markdown Section index: [Security and privacy](https://www.tabflows.com/university/library/security-and-privacy.md) Alongside this page: - [Get HIPAA compliant automation with tabflows](https://www.tabflows.com/university/library/security-and-privacy/get-hipaa-compliant-automation-with-tabflows.md) - [HIPAA compliant no migration no it setup](https://www.tabflows.com/university/library/security-and-privacy/hipaa-compliant-no-migration-no-it-setup.md) - [How tabflows protects your data](https://www.tabflows.com/university/library/security-and-privacy/how-tabflows-protects-your-data.md) - [Tabflows healthcare security standards](https://www.tabflows.com/university/library/security-and-privacy/tabflows-healthcare-security-standards.md) Start here: - [Tabflows](https://www.tabflows.com/index.md) - [Tabflows pricing](https://www.tabflows.com/pricing.md) - [Tabflows FAQ](https://www.tabflows.com/faqs.md) - [About Tabflows](https://www.tabflows.com/about.md) - [Contact Tabflows](https://www.tabflows.com/contact.md) - [DPC workflow software](https://www.tabflows.com/dpc-workflow-software.md) - [Directory](https://www.tabflows.com/directory.md) - [Workflows](https://www.tabflows.com/workflows.md) - [DPC finder](https://www.tabflows.com/dpc-finder.md) Every page listed in sitemap.xml has a markdown twin at the same URL with `.md` appended, or by sending `Accept: text/markdown` to the canonical URL. Wider index: [llms.txt](https://www.tabflows.com/llms.txt), [llms-full.txt](https://www.tabflows.com/llms-full.txt), [sitemap.md](https://www.tabflows.com/sitemap.md), [sitemap.xml](https://www.tabflows.com/sitemap.xml). Support documentation: https://www.tabflows.com/university/library — append `.md` to any article URL for its raw markdown.