Security and Data Handling

Encryption in transit

DxCopilot is served only over HTTPS. Requests made over plain HTTP are redirected to HTTPS.

Account protection

Passwords are stored as bcrypt hashes and never in readable form.

Sign-in and the public forms are rate limited, and a closed or suspended account loses access immediately rather than at the end of its session.

Access to clinical records

Every request for clinical data is limited to the account that owns it before anything else is read, so one account’s records cannot be reached from another account’s session.

What is sent to the AI provider

Clinical AI Analysis sends the clinical context of that encounter: age, sex, recorded allergies and current medications, intake findings and scores, summaries of attached reports and your notes. Patient identity is not needed, and direct identifiers should not be entered.

Quick Prescription & Notes sends only the dictated or typed text of one visit. A patient name introduced with a recognized phrase, such as “patient name is”, is replaced with a placeholder in your browser before sending; a name given another way may still be sent.

What is stored

The dictation transcript is not stored, and prescriptions and clinical notes are kept only when you save them.

For Solo Doctor accounts, attached report files are not stored: their text is extracted in memory, only that text is sent for analysis, and the files are discarded.

An analysis and the suggestions that come back are stored in the consultation record so you can review them later.

AI model training

DxCopilot does not sell submitted clinical information or use it to train its own AI models.

Retention and deletion

Patient records, consultations and uploaded reports are kept for as long as the account holder keeps them, and are deleted when they delete them or when the account is closed and the agreed retention period has passed.

If something goes wrong

No system is perfectly secure, and we do not claim otherwise. If a breach affects your account or your patients’ information, we will tell you and any regulator we are required to tell, without undue delay.