Security & compliance
Patient data protection is a first requirement at Zeteo.
Zeteo works with patient records, messages, care plans, and the documents clinicians and patients share with it. Here's how we protect that information, what we will not do with it, and how to verify both.
Assurance
Certifications and agreements.
- SOC 2 certified Zeteo's controls for security, availability, and confidentiality are independently audited. The report is available to customers and prospects under NDA through our trust center.
- HIPAA by design, BAA-backed Zeteo signs Business Associate Agreements with covered-entity and business-associate customers. HIPAA has no certification program, so compliance is a shared responsibility between Zeteo and each customer's configuration and use of the platform.
Data handling
How we handle patient data.
Encryption
Encrypted in transit and at rest
Records, messages, uploads, and generated drafts are encrypted in transit and at rest.
Access
Role-based access, logged
Access to patient data is limited by role and organization, and every access is logged.
On-site
Edge keeps inference local
With Zeteo Edge, drafts are generated on a server inside your practice. Patient records are processed on your network, software updates never carry them, and support sees records only in sessions you authorize.
Review
A clinician approves every draft
No reply, note, care plan, or appeal reaches a patient or a payer without review and approval by the responsible professional.
Retention
Retention scoped to purpose
Patient data is retained only as long as needed for the service, under the terms agreed with each customer, and returned or deleted at the end of an agreement.
Transparency
You can see what Zeteo learned
Clinicians can view what Zeteo has learned about how they practice and change or remove it.
Commitments
What Zeteo does not do.
No selling data
Patient data is never for sale
Zeteo never sells patient records or anything that identifies a patient, and shares your data with third parties only as needed to deliver the service under a BAA.
No silent training
Nothing identifiable trains anyone else's model
Identifiable records and messages are never used to train models for other customers, and each clinician's personal tuning stays in your deployment. Only de-identified statistics and model updates are shared, as set out in your agreement, and you can switch that off at any time in your settings.
No autonomous action
Nothing goes out unreviewed
Zeteo drafts. It does not send messages to patients, write to the chart, or submit to payers on its own.
No clinical decisions
No clinical determinations
Zeteo surfaces evidence with its sources and supports communication. It does not make diagnoses, treatment decisions, or coverage determinations.
No cloud PHI on Edge
Edge stays on your network
With Zeteo Edge, patient records are never sent to a cloud AI service. Inference runs on hardware inside your practice, and data leaves only where you direct it, such as to your EHR.
No emergencies
Not for emergency use
Zeteo Advocate routes patients to emergency services when something cannot wait. It is not a substitute for a clinician or for 911.
Have a specific security question?
For our SOC 2 report, BAA terms, security questionnaires, or a review as part of your procurement process, reach out directly.
Contact our team