Separate internal administration
Central runs on a separate host. Verified identity and active team permissions are checked before internal operations.
Assess MedFlow before you buy.
Current release: synthetic demonstration. Real patient-data use is not approved. This overview describes implemented application controls and outstanding review requirements; it is not a compliance certification.
Reviewed September 26, 2026.
Request a security reviewCurrent application controls
Scoped hospital and patient access
Hospital memberships and clinician invitations determine access. A sales inquiry creates no hospital tenant, patient account, or clinical entitlement.
Recorded administrative changes
Hospital, team, and sales changes retain audit history. Updates use record versions to prevent silent overwrites.
Human review and release gates
Clinical outputs remain under clinician review. Required production evidence and approvals must be completed before live patient-data processing.
Evidence to review for a proposed deployment
Request the evidence relevant to your hospital. Availability and approval must be confirmed; these documents are not all approved today.
- Deployment-specific data flow, hosting region, encryption, and access configuration.
- AI vendors, subprocessors, data use, recording, retention, and deletion arrangements.
- Risk assessment, independent security testing, incident response, and recovery evidence.
- Applicable agreements, staff training, clinical evaluation, and go-live responsibilities.
Detailed infrastructure and security evidence should be shared through an agreed controlled review process. Do not upload patient information to the demonstration or inquiry form.
Review before payment.
Resolve supplier, technical, and contract questions before moving into the paid onboarding process.
View purchasing information →