The drug-safety AI clinicians can use on real patients: cited answers from the FDA label, from a server that never sees the patient.
See it8 passages fetched · the server can't tell which
See it work
Charts come from your EHR over SMART on FHIR, and stay on the laptop.
A local AI model answers from the FDA label passages it fetched, and cites every claim.
One encrypted question and eight private fetches. Zero readable bytes, checked after every answer.
Does it work?
23 drug-safety questions that the FDA label answers. The same AI model on the same laptop, once answering from memory like a chatbot, once through BlindSpot.
questions the chatbot got right, answering from memory. It failed the other 22.
questions BlindSpot got right, every one with a citation to the label.
times the chatbot answered a question no source covers. BlindSpot said it couldn't, 3 of 3.
The question:
Nadia, 27, synthetic patient, takes tizanidine. Urgent care prescribes ciprofloxacin for a UTI. Is it OK with her other medicines?Same model, no sources
“Ciprofloxacin is generally safe to take with these specific medications.”
BlindSpot
“Ciprofloxacin is contraindicated with tizanidine 1. It is not OK.”
Six more of the 23, with what each one said and the label line that settles it.
Contraception
Nadia, 27, on a combined pill
1 Tirzepatide (Zepbound) FDA label
Contraception
Nadia, 27, on a combined pill
1 Paxlovid FDA label, drug interactions
Cardiology
Walter, 71, on clopidogrel
1 Clopidogrel FDA label
Kidney function
Walter, 71, eGFR 42
1 Nitrofurantoin FDA label
Breastfeeding
Postpartum, breastfeeding
1 Hydroxyzine FDA label
Pregnancy
A label that changed
1 Atorvastatin FDA label, current version
Synthetic patients. Chatbot arm: qwen3.5:9b answering from memory with the same chart. Graded against the quoted FDA label text. Read the full evaluation.
Why it matters
To answer, every clinical chatbot reads the question, the chart and what you looked up, and keeps them in someone else's logs. So hospitals ban it, clinicians use it anyway, and questions go unasked. BlindSpot is the one place it can't see.
questions raised per patient seen. Only about half are ever looked up, mostly for lack of time.
JAMA Intern Med, 2014of US physicians now use AI in their practice, up from 38% in 2023.
AMA survey, 2026of physicians call data privacy critical to adopting AI more widely.
AMA survey, 2026of generative-AI data-policy violations in healthcare involve regulated data.
Netskope Threat Labs, 2026Clinicians should not rely on HIPAA compliance as a proxy for fulfilling their duty to maintain patient confidentiality.Mason Marks and Claudia Haupt, JAMA, 2023
Can I trust it?
The three questions a privacy review asks, answered by the app itself, after every answer.
What leaves the laptop?
One encrypted question and eight private fetches: about 500 KB, and 0 readable bytes. A live ledger lists every request the laptop makes. Anything off the allowlist is blocked before it connects.
Who can read it?
Only the laptop. The server ranks and fetches passages on ciphertext, and a relay hides who is asking.
Can you prove it?
After every answer, BlindSpot replays exactly what the server received and tries to read it.
The one-time key upload holds only public and evaluation keys.
Decrypting the encrypted query with everything the server holds fails.
Every byte sent is decoded and searched for words from the question and the chart. Found: zero.
Each fetch query touches all 20,000 passages and looks uniformly random.
These checks catch mistakes. The guarantee itself comes from the math: Tiptoe for the search, SimplePIR for the fetch.
The product
A clinician workspace that runs on the laptop: patients from the EHR, questions by voice or text, answers with sources, and a receipt for every byte that left.
Pick the patient and keep the chart items you want. Ask by typing or speaking. Answers cite the passages they draw on, and say when the sources don't cover something.
Avoid, caution or no warning found, then the reasons, each with a numbered source.
Her fluid is already low-normal, so the answer says so, cited to the chart itself.
A live ledger lists every request the laptop made: where it went, how big it was, and whether it was readable. Readable bytes: zero.
The client can only reach the relay and the local model. Anything else is blocked before a name is resolved, and the block shows up here.
/score carries the encrypted question. /fetch carries eight private-fetch queries. Nothing else leaves.
The manifest, the 4 MB fetch hint and the safety feed are the same bytes for every user, so downloading them reveals nothing.
After every answer, BlindSpot replays the server's side using only the bytes the server received, and tries to read them. Four checks, in the app.
The checks use only what the laptop sent to the relay for this answer, kept in memory and never written to disk.
Every field is base64-decoded and searched for phrases from the question and the chart. Found: zero.
The same checks run as a script against a recorder in front of the real server.
Charts arrive from the EHR and labs over HL7 v2, onto the laptop only. The medicine-pair grid shows which combinations have been checked, and how they came out.
Avoid, caution, no warning found, or not checked yet. One click checks a pair privately.
FHIR R4 with SMART sign-in (PKCE), an HL7 v2 lab feed over MLLP, FHIR Bundle and HL7 file import, and a sandbox of synthetic patients.
An HL7 v2 lab result, mapped segment by segment to FHIR Patient, DiagnosticReport and Observation resources.
Dictate the question and watch the words appear. Whisper transcribes on the laptop as you speak, and the audio never leaves.
SMART on FHIR sign-in with PKCE. Charts are sealed on disk, and the context the model sees drops name, birth date and MRN.
An HL7 v2 listener receives results over MLLP, acknowledges them, and merges them into the chart.
One public feed of FDA safety notices, the same for everyone, matched on the laptop against each patient's medicines.
Rebuilt from FDA labels and MedlinePlus, checked, then hot-swapped. Label changes reach answers without retraining anything.
When the library has no good match, a local model splits the question into generic searches plus decoys, scores the leak, and sends nothing until you approve.
Every answer is saved as an encrypted file on the laptop, never synced. Pick 30-day, 1-year or no expiry. Export as FHIR DocumentReference.
If the sources don't cover a question, BlindSpot says so instead of guessing, and offers a reviewed web search.
How it works
The server does all the heavy lifting on ciphertext. Three layers each close a different leak: Tiptoe hides the question and the scores, SimplePIR hides which passages you read, and a relay hides who asked.
The question and chart context become 384 numbers, encrypted for Tiptoe search. The secret key never leaves.
bge-small-en-v1.5 · Tiptoe
The server multiplies the encrypted question by every passage and returns encrypted scores. It never sees one.
20,000 passages · 7.3 s
The laptop picks the best 8 and fetches them with SimplePIR. Each query touches every passage.
LWE n = 1024 · q = 2³² · σ = 6.4
A local model writes the answer from those 8 passages and the chart, citing each claim.
Ollama · qwen3.5:9b
Everything. The only place the question, the chart, the scores and the answer exist in readable form.
The laptop's IP, ciphertext sizes and timing.
Never the question, the embedding or the results.
Sizes, timing, and that a query happened.
Never the question, the scores, the chosen passages or who asked.
Our crawl of public .gov health pages, to build the library.
Never a clinician's question.
readable bytes sent per question. Checked after every answer.
encrypted search over 20,000 passages, on one laptop. The same top 8 as unencrypted search.
uploaded per question, plus a one-time 35 MB key upload per session.
fetches every time, whatever the question, so the count can't leak how good the matches were.
security estimate for the private fetch, from the SimplePIR parameters.
Would anyone use it?
Health systems
Instead of reviewing a vendor's privacy policy, read the egress ledger: every byte that left, and a replay of what the server saw.
Sensitive-care clinics
Where a query log is a liability, BlindSpot's server has nothing readable to hand over: no questions, no charts, no record of what was read.
Pharmacists and urgent care
A third of clinicians' questions are about drug treatment. BlindSpot answers from the label, for this patient, in seconds.
The vendor receives and reads the question, and usually stores it. A business associate agreement assigns blame after a breach. It doesn't prevent one.
Answers from memory frozen at training time. When no source covered a question, it answered anyway, 9 times out of 9.
Correct, but it takes minutes the visit doesn't have. Clinicians pursue only about half of the questions they raise.
Cited answers from current FDA and NLM sources, in seconds, from a server that holds no key to read the question.