Quick-case text and structured fields live in page memory. The raw text is parsed and discarded locally; no local storage, cookies, URL parameters, or analytics events contain case data.
Privacy architecture
No HPI. No identifier fields. No case history.
The consult is deliberately narrower than a clinical note. Its constrained quick-case composer recognizes only age, sex, trimester or gestational week, and medication names or doses. The browser converts that text into reviewed structured values and discards it locally; only the de-identified structured case and a retrieved evidence packet are sent to the OpenAI API.
Request data flow
Validates the schema, rejects identifier-like content, checks red flags, and retrieves only relevant v0.95 evidence.
Receives a de-identified case and evidence packet with store: false. It returns a constrained JSON brief.
The brief renders in the browser and is cleared on command or page exit. This application does not persist it.
Accepted
De-identified clinical variables
- Age or age band—not birth date
- Sex and gestational week or trimester
- Diagnosis category, severity, and course
- Medication, formulation, optional numeric dose, and response
- Selected obstetric and medical modifiers
- Decision position and primary clinical question
- Safety signals from predefined checkboxes
Prohibited
Identifying or narrative content
- Name, initials, date of birth, or exact dates
- Medical record, insurance, or account numbers
- Phone, email, IP, device, or contact details
- Street address, ZIP code, employer, or facility
- Photographs, documents, audio, or file uploads
- Narrative HPI, note paste, or patient quotation
- Any unusual detail that could re-identify a person
Quick-case boundary
The text box is a local parser, not a narrative request field.
It accepts only age, sex, trimester or gestational week, and medication names or doses. Unrecognized or ambiguous text is blocked for correction. After clinician review, only normalized structured values may be submitted; the raw quick-case text is never transmitted to the Worker or OpenAI and is not saved by the application.
Important distinction
store: false is not Zero Data Retention.
The application disables Responses API application-state storage and does not use conversations, threads, vector stores, file search, background mode, or web search. OpenAI’s default API controls may still retain customer content in abuse-monitoring logs for up to 30 days. The API does not use customer inputs or outputs for model training by default.
A literal zero-retention claim requires an OpenAI organization and project approved and configured for Zero Data Retention. Until that control is verified, this commissioning preview must accept de-identified cases only and must not process PHI.
Production gate
Verify OpenAI ZDR project status, contractual requirements, Cloudflare Access, organization policy, incident response, logging configuration, and legal/security review before clinical deployment.
Application controls
- Persistence
- No application database, case table, chat history, server session, localStorage, or IndexedDB.
- Transport
- HTTPS only in production; strict transport and no-referrer headers.
- Caching
no-storeon the consult page and every API response.- Telemetry
- Cloudflare Worker observability disabled in source configuration; no third-party analytics or session replay.
- API key
- Server-side Cloudflare secret only; never included in browser code or committed files.
- Retrieval
- Versioned local JSON evidence; no patient case is written into a vector store.
This page describes the application design, not a legal conclusion or a substitute for a formal privacy, HIPAA, security, or regulatory assessment.