The building is the boundary
The simplest privacy architecture is the one where the data never goes anywhere. That is the whole design.
The appliance has one connection: the clinic's own network, to the clinic's own workstations. The connections it does not have are drawn as what they are, lines that stop at the wall.
How it is deployed
- Data at rest
- On the appliance, inside the clinic.
- Data in transit
- Between the appliance and the clinic's own workstations. Nowhere else.
- Outbound connections
- None required for any stage of processing.
- Models
- Run locally on the appliance. No request to a third-party service.
- Vendor access
- None. There is no remote access path. Support is done on site.
- Updates
- Installed from media the clinic controls, on the clinic's schedule.
01The sealed box
AirGapped Health is delivered as an appliance that sits in the clinic's own premises. It is installed from local media. It holds the patient records, the processing, the models and the review interface. Staff reach it over the clinic's own network.
There is no vendor portal, no tenant, no account with us, and no upload step.
02The page ledger
Every page is in it exactly once
Each page that arrives ends in one line of a ledger: read, unreadable, or no clinical content. The ledger is reported as a partition of the package, not as a count, so a missing page has nowhere to hide: the lines either add up to what was received or they do not.
A page the software could not read is reported as unreadable. It is never counted as read.
Fourteen pages received, fourteen pages in the ledger. Ten read, one unreadable and listed as such, three with no clinical content. The total is a check the reviewer can do in their head.
Synthetic example03The record
Append-only, and signed against what was reviewed
What happens to a case is written to a record that is only ever added to. A correction is a new entry. Nothing is edited in place, so the history of the history is still there when someone asks for it.
When a clinician signs, the signature binds to the content, not to the run. If anything changes afterwards the signature no longer stands, and the packet says so.
The record only grows. A correction is a new entry under the old one. The old one stays where it was.
The signature is tied to the content that was reviewed. If the content changes, the tie breaks, and the packet says so.
04Why it matters
Why that matters more at scale
A hosted service processing a thousand-page file has that file. So does its infrastructure provider, its logging, its backups and anyone who breaches any of them. Each of those is a question a clinic's privacy officer has to ask, and each needs an answer that is a promise rather than an architecture.
An appliance with no outbound connection answers all of them the same way.
05Regulatory position
Stated honestly
The software is designed against Ontario's Personal Health Information Protection Act and the guidance of the Information and Privacy Commissioner of Ontario. Whether a deployment meets the Act is a determination a clinic makes about its own practices. It is not a badge a vendor can award itself, and we do not claim one.
What we provide toward that determination: a privacy impact assessment, a written confidentiality undertaking, an installation record, a breach response procedure, and a description of exactly what the system does with each page it receives.
Current status
The software is in development and is not yet in clinical use. No real patient record has been processed. Development is carried out on synthetic corpora only.
06This website
Held to the same standard, and you can check
This site makes no request to any other host. Every font, style, script and drawing on it is served from airgappedhealth.com, and its content security policy forbids the browser from loading anything else. It sets no cookies.
It does run script: a few small files of our own, served from this domain, that draw the 3D model of a made-up fax package on the front page and on the Inside page, start the illustrations as you scroll, and set up the demo film's player, poster and captions only when you reach it. Nothing third-party, nothing inline, nothing that phones anywhere. With script switched off every page still reads in full and every drawing is complete.
It counts visits without watching visitors. Our own server adds one to a tally for the page and the day. No cookie, no identifier and no address are stored. The one thing kept about the browser is whether it looked like a search robot. No analytics company is involved.
- Open your browser's developer tools, choose the Network panel, and reload. Every request goes to airgappedhealth.com.
- Look at the response headers of any page. The
content-security-policyheader starts withdefault-src 'none', and after that names no host except this one: every entry is'self'or'none'. - Look at the Storage or Application panel. There are no cookies and nothing in local storage.