Legal
Privacy Policy
How data is handled across the website, local tools, hosted workspace and manual assessments. Last updated October 17, 2026.
What we collect
Website requests involve technical connection information; configured analytics and abuse-protection services may process additional usage or verification information. Contact and support requests include the details you submit. Hosted workspace accounts, saved records and optional integrations are described below. For a manual assessment, we receive the agreed artefacts and contact details needed to run the engagement.
Hospital patient records, documents and portal
The hospital information workspace can receive and store identifiable patient information and PHI: demographics and contacts, identifiers, medical histories and documents, visits, scheduling and related hospital records. The patient portal has separate accounts, consent/access records, released content and private messages or attachments. Native actions, imports and uploads send data to the configured server. Import staging can retain an encrypted upload before its reviewed records are applied. Patient and document payloads use application encryption at rest with authenticated hospital/record binding. Account, operational and audit metadata are stored separately. Encryption does not prevent authorized application access or an operator holding the key from reading data. Downloaded copies and backups need their own handling and retention controls. There is no automatic general-purpose retention expiry or deletion of downloaded copies and backups.
Staff onboarding, credentials and time logs
Hospital staff profiles can include professional identifiers, credential and verification references, approval history, Doctor roster links, assigned locations and departments, shift schedules and attendance. These are personal information even when patient intake is disabled. Access depends on hospital membership and saved permissions; access previews do not activate an account or approve professional privileges. The hospital and operator must agree authorized purposes, reviewers and retention for workforce information separately from patient records. Removing access does not automatically erase historical records, downloaded reports or backups.
Reviewed patient-record exports
Authorized records staff and managers can preview and download a reviewed copy of one patient's current details and selected history, documents and appointments. Requester identity and representative authority are recorded staff attestations. Preparing the download requires the reviewer's password and configured MFA, and creates audit metadata. The short-lived encrypted review ticket stays in browser memory; the file includes an opaque case reference and embedded document content, without staff account/credential datasets or unrelated patient records. Free text and attachments still require human review for third-party information. Other clinical modules, portal messages, billing and prior versions are excluded, so this copy is not automatically a complete response to an access request. Delivery to the verified recipient and retention of downloaded copies remain separate responsibilities; the application does not send the package automatically.
Operator authorization for patient-data ingestion
Real-patient recording requires server operator configuration selecting real-data mode and asserting that a BAA exists. These settings are not controlled by a hospital member or an upload. The application does not verify the agreement or certify compliance. Synthetic-only mode is limited to loopback demonstrations or temporary fixtures without a public origin and is an operator assertion, not a PHI detector. Patient-data intake is disabled by default; existing authorized read access is separate from this write gate. The hospital and operator must agree processing scope, responsibilities, providers, retention and safeguards before using real records.
What an assessment involves
Manual assessment services are scoped separately from the hosted workspace. Assessment files are handled on an encrypted device or in an agreed customer-controlled environment, used only for the engagement, and not used for model training or cross-customer benchmarking. The local tools, hosted workspace and optional integrations have distinct data flows described below.
Local browser assessment tools
The local firewall rule reviewer and local hospital assessment tool process policy, inventory, access requirements and review actions in your browser tab. These local tools do not submit the contents to Guardra, store them on a server, or save them in browser storage. Reloading or clearing the local workspace removes the input and findings. Downloaded assessments, templates and reports remain wherever you save them; assessment files and reports include the input data and saved review actions. You can reopen a downloaded assessment to continue locally. The pages still load normal website assets and any configured page analytics. The separate hosted workspaces send account requests, saves, uploaded/staged data and workflow submissions to the configured server; their patient-data flows are described above.
Hosted security workspace
Creating or joining a team workspace stores your account email, hospital membership and a salted password hash on the configured Guardra server. Choosing Save to hospital sends your assessment and saved review actions to that server. Clinical device, exposure and incident records are also sent when you explicitly save their register; its latest 50 encrypted snapshots are retained, with older snapshots removed from the application database on subsequent saves. Downloaded registers and briefings contain the recorded infrastructure and incident details. Assessment revisions are encrypted by the application; account and audit metadata are stored separately. Connector credentials submit source observations to an encrypted intake queue for administrator review. Connector credentials and retry identifiers are hashed; connector names, timestamps, counts, receipt statuses and audit metadata are stored separately. Up to 50 pending batches and the latest 50 reviewed payloads are retained; older reviewed payloads are removed while receipt metadata remains. An administrator may authorize a connector to send data on an ongoing basis. Sessions and invitations use hashed tokens. Optional two-factor authentication stores encrypted authenticator secrets and hashes of single-use recovery codes. Security changes and recovery-code use create audit events without recording the codes. Downloaded recovery codes remain wherever you save them. Administrators can remove members and delete assessments and their saved revisions. Audit event metadata remains. Assessment revisions have no automatic retention expiry; clinical register snapshot retention is described above. No automatic backup deletion is implemented. The installation operator controls hosting, backups and retention. Team saves are separate from the manual assessment service and its handling terms.
Microsoft sign-in and security AI assistance
When hospital Microsoft sign-in is configured, Guardra uses Microsoft tenant and user identifiers to match an explicitly linked existing member. Microsoft sign-in does not grant a new hospital membership automatically, and Guardra MFA still applies. When evidence copilot generation is enabled and requested, your question and selected workspace evidence excerpts are sent to Amazon Bedrock in Ohio (us-east-2). This is separate from local browser assessment tools. Copilot output is read-only assistance requiring human review. The optional security risk agent may use configured US AWS regions and stage assignments for human approval; its approved lessons remain scoped to that hospital. Patient-record datasets and portal content are not tools available to the security agent. Do not enter patient information into security prompts, free-text evidence or security event uploads. Confirm that the proposed data is appropriate for the configured service before requesting generation.
Manual assessment flow records
A separately scoped manual network assessment may use metadata such as addresses, ports, direction, volume and timing. This limitation does not describe the hospital patient-record workspace, which can contain PHI. Note that HHS de-identification guidance lists IP addresses and device identifiers among its identifiers, so the absence of packet payload does not by itself mean an export is free of PHI; that depends on content and context. If an export could contain payload or identifiers, say so and we scope it out or run the analysis inside your environment instead.
Where manual assessment files live
Encrypted at rest on a device under our control, or inside your own VDI where nothing leaves your environment at all. No cloud processing of customer artefacts, no third-party analysis service, and no copies beyond what the engagement requires.
Manual assessment retention and deletion
Artefacts are deleted within 30 days of the report being delivered, or immediately on written request. Written confirmation of deletion is provided. The report itself is yours; our copy is deleted on the same schedule unless you ask us to keep it.
What we never do
Publish, reuse or reference your findings without written permission. Share artefacts with anyone. Use one engagement's material to inform another. Sell personal data.
Your rights
UK GDPR, EU GDPR and CCPA: access, rectification, deletion, portability, restriction. Write to privacy@guardra.ai — response within 30 days.
Subprocessors
The Trust Centre describes hosted workspace infrastructure and supported email, identity, abuse-protection, analytics and AI integrations. Optional integrations are not necessarily active for your deployment, and that overview is not a verified contractual subprocessor register. Confirm active providers, processing locations and agreements before onboarding. Manual assessment handling is separately agreed; the workspace operator controls application storage and backups.