Security

HIPAA compliant

Preface is built to be HIPAA compliant. Health information is protected by business associate agreements with the services that process it and by zero data retention, so your messages are used only to generate your response and are not kept.

How we protect your information

• Everything is encrypted in transit.
• Your conversation is never stored on our servers.
• Your messages are never used to train any AI model.
• We collect the least data possible and require no account.
• No health information is written to our logs or analytics.
• Strict security headers, a content security policy, and rate limiting protect the service.

Who processes data for us

OpenAI generates responses under a business associate agreement and zero data retention. Vercel hosts the application under a business associate agreement. Any service that could touch your information is covered; our analytics and rate limiting handle counts only and never see message content.

Reporting an issue

If you believe you have found a security problem, please write to security@prefacemed.com. We appreciate responsible disclosure.