Constrained quick-case text and fields; no HPI, files, identifiers, cookies, or local case store.
Internal technical disclosure
Technical architecture
Stateless by design. Evidence-bounded by construction.
Astro renders the product shell and a Cloudflare Worker handles sensitive requests. The clinical path retrieves a small, versioned evidence packet locally and sends only that packet plus a validated de-identified case to OpenAI.
Request path
Six boundaries, one ephemeral result.
Parses and discards quick text locally, then checks reviewed normalized fields before submission.
Same-origin, content type, body size, schema, identifier, and safety checks.
Deterministic selection from the bundled v0.95 evidence index.
Server-side Responses API call with structured output and store: false.
Allowed claim IDs only; no-store delivery; cleared when the browser leaves.
Production shell
Small runtime, explicit controls.
The application uses Astro 7, the official Cloudflare adapter, Cloudflare Workers, TypeScript, Zod schemas, and the official OpenAI JavaScript SDK. The evidence export is normalized into a compact server bundle before every development, check, and production build.
- Rendering
- Astro server output on Cloudflare
workerd - Model access
- Server-side OpenAI secret; never compiled into browser JavaScript
- Retrieval
- Versioned local JSON; no case-bearing vector store
- Sessions
- Fail-closed driver rejects persistence and prevents KV session use
- Telemetry
- Worker observability disabled; no analytics or session replay
- Caching
- No-store on consult and API routes; static assets remain cacheable
Privacy boundary
“No application persistence” is precise. “No processing” would be false.
- Case forms or prior consults
- Patient identifiers or narrative HPI
- Model prompts or generated briefs
- Browser localStorage or IndexedDB state
- Server sessions, case tables, or vector records
- Case bodies in product analytics
- The clinician’s HTTPS request at Cloudflare
- The validated de-identified case in the Worker
- The evidence packet and de-identified case at OpenAI
- The structured output during the active request
- Operational metadata required to deliver network services
- Vendor data subject to verified account controls and contracts
De-identification lowers privacy risk; it is not permission to paste a chart. The quick-case box accepts only age, sex, trimester or gestational week, and medication names or doses; its raw text is never transmitted or saved by the application. Names, exact dates, record numbers, contact details, addresses, facilities, quotations, and unusual re-identifying details remain prohibited.
Retention caveat
OpenAI data controls
store: false is not Zero Data Retention.
The clinical request disables Responses API application-state storage and does not use conversations, background mode, OpenAI Files, File Search, vector stores, or live web search. Those choices reduce persistence and external data flow.
Under OpenAI’s default API controls, customer content may still be retained in abuse-monitoring logs for up to 30 days. API inputs and outputs are not used to train OpenAI models by default unless the organization explicitly opts in.
A literal zero-retention claim requires an OpenAI organization and project approved and configured for Zero Data Retention. Until that configuration, contracts, and vendor controls are independently verified, this preview must accept de-identified cases only and must not process PHI.
Read OpenAI’s current API data controlsModel contract
The model may synthesize. It may not expand the evidence base.
Only the validated case object and retrieved records, claims, and sources.
JSON Schema constrains required sections, uncertainty, citations, and flags.
Every returned claim identifier must exist in the evidence packet.
Missing or unverified evidence becomes a visible limitation, not fluent filler.
Emergency and severe-risk signals route away from routine model guidance.
Every brief carries the evidence version, cutoff, and commissioning status.
Cloudflare Workers
Build, verify, deploy.
The current Astro adapter targets Cloudflare Workers rather than Cloudflare Pages. The API key must be uploaded as a Worker secret.
Local verification
npm ci
npm run qa
npm run previewSet or rotate the production secret
npx wrangler secret put OPENAI_API_KEYDeploy the verified build
npm run deployCommissioning gates open
Deployment is not authorization for clinical use.
Evidence commissioning, gold-standard case validation, privacy and security review, OpenAI retention verification, regulatory assessment, clinical governance, living-evidence operations, and named external sign-off remain open.