Security and IT review
Written for information-security, privacy, and IT teams evaluating Daedalus Health. This page describes how the live product actually works. We do not claim certifications we do not hold.
PHI
Daedalus Health does not touch or process PHI.
No EHR connection. No patient records. Do not upload protected health information to this site.
This product does not process PHI
Daedalus Health is an advisory and program-operations workspace. It is not an EHR, not a clinical data repository, and not a patient-care system of record.
The site and partner portal do not connect to electronic health records, do not ingest claims, ADT, imaging, or lab feeds, and are not designed to create, receive, maintain, or transmit protected health information (PHI).
Do not upload patient names, medical record numbers, PCRs, encounter notes, or other PHI. If something looks like PHI, do not paste it here — use your organization’s clinical systems instead.
What the service is for
Health system leaders use Daedalus Health for AI governance work, vendor evaluation, and related advisory materials. Emergency medical and air-medical programs can use a separate workspace to prepare CAMTS Program Information Form content and policy drafts.
Accounts are issued to named professionals at customer organizations. Access is limited to that organization’s workspace.
What we store
- Work contact details for accounts and inquiries (name, email, title, organization).
- Organization profile information you provide (for example program name, contacts, and high-level operational metadata).
- Workspace content you choose to enter: governance notes, policy drafts, PIF narratives, and uploaded program documents.
- Authentication sessions, needed so you can sign back in.
- We do not sell personal data. See the Privacy Policy for what we collect and how the service is used.
Access and authentication
Customer logins are invite-based. Users sign in with a password or a one-time magic link sent to their work email.
Passwords are stored as hashes by Supabase Auth. We generate sign-in and password-reset links ourselves so they always point at daedalushealth.ai — never a local or preview host.
Each user is scoped to their organization through membership records. The operator console is limited to Daedalus Health administrators.
Infrastructure
The application is hosted on Vercel and served over HTTPS.
Authentication and application data live in Supabase (Postgres with row-level security for organization data).
Transactional email is sent through Zoho Mail for daedalushealth.ai.
Data in transit is encrypted with TLS. Data at rest is encrypted by those infrastructure providers.
Optional AI drafting
Some workspace tools can draft policy or PIF language from notes and documents you provide, using the OpenAI API.
Those features are writing aids, not clinical decision support. They are instructed not to use PHI. You must not upload PHI into them.
If your review requires OpenAI’s current API data-use terms, request a security packet and we will include them.
Subprocessors
- Vercel — application hosting and content delivery.
- Supabase — authentication and database.
- Zoho — transactional email.
- OpenAI — optional drafting when a user runs an AI draft in the workspace.
BAAs and questionnaires
Because this product does not handle PHI, a Business Associate Agreement is not required for ordinary use of the website or portal.
Many health-system counsel still want a BAA on file for any vendor relationship. We will execute one on request.
We will also complete reasonable security questionnaires and share a security packet (architecture summary, subprocessors, and related materials).
Contact
BAA and security-packet requests go to welcome@daedalushealth.ai. You can also use the short form. For suspected security issues involving this site, email the same address. Do not include PHI in that message.
Privacy questions can be sent through the same channel. Do not include PHI.