The short version
This website sets no cookies, runs no analytics and loads nothing from anyone else's servers. The BlindSpot app is built so that a patient's chart and a clinician's questions never leave the laptop in readable form. This page explains both.
This website
- No cookies, no tracking. We don't set cookies, use local storage to follow you, fingerprint your browser, or run analytics, advertising or session-recording tools.
- Nothing from third parties. Fonts, images, styles and scripts are all served from this domain. The server sends a Content-Security-Policy that blocks the page from loading anything else.
- Request logs. Our web server keeps no access log. The site is hosted on Railway, whose network may record standard request data such as IP address, time, requested page and browser type to run and protect the service, under Railway's privacy policy.
- Links out. Links to GitHub, journals, government sites and news sources take you to services with their own privacy policies.
- Nothing to sell. We collect no personal information through this website, so there is none to sell, share or hand over.
The BlindSpot app
BlindSpot is a research prototype that runs on the clinician's laptop.
- Stays on the laptop: the chart, the question, the encryption keys, the decrypted scores, the fetched passages, the answer and saved consults. Saved consults are encrypted files on the laptop and are never synced.
- Leaves the laptop, encrypted: one encrypted Tiptoe search query and eight SimplePIR private-fetch queries per question, sent through a relay. The server sees their sizes, their timing and that a query happened, never their content. The relay sees the laptop's IP address, sizes and timing, and keeps no access log.
- Public downloads: the library manifest, the private-fetch hint and the FDA safety feed are the same files for every user, so downloading them reveals nothing about a patient.
- Optional web search: only if the clinician reviews and approves it, generic one-concept search terms mixed with decoys go to Tavily and Exa, which see those terms and the laptop's IP address.
The full threat model, including what each party can and can't see and the current limits, is on How it works.
Real patient data
The prototype has not been independently audited or validated for use with real patient data. Use it only with synthetic or properly de-identified data. The demo uses synthetic patients only.
Changes and contact
If this policy changes, we'll update the date at the top of this page. Questions: open an issue on GitHub.