What the system reads, what it excludes by construction, where the data lives, and how to get it back. Written to be attached to a clinic's own privacy review; the companion document formatted for a privacy impact assessment is available on request.
Three fields from the clinic's own export: referring clinician, date, and modality. They are aggregated to monthly counts per clinician, and those counts are the entire dataset: a referring clinician's name against how many studies they sent each month.
No patient field is read, stored, or transmitted. A long-format billing export is aggregated to monthly counts at the moment of upload, before anything is stored, so patient-level rows do not reach the system even in transit through it. There is no patient table, no field for patient data, and no place to put one; the exclusion is enforced by the schema itself.
Each clinic runs its own deployment; nothing is pooled across clinics, and no clinic is benchmarked against another. The infrastructure is in the United States. What crosses the border is the monthly counts described above.
| Subprocessor | What it holds | Region |
|---|---|---|
| Vercel | The application and the monthly count files it serves | United States |
| GitHub | Version history of the same monthly count files | United States |
| Convex | The team's outreach call list and contact notes | United States |
The dashboard is closed until a password is presented; passwords are verified server-side and never shipped inside the application code. Sessions carry a signed, short-lived token. Time-limited access codes can be issued and revoked individually. The vendor can see what the clinic can see, which is monthly counts.
The dataset is a small set of monthly count files, exportable by the clinic from inside the product at any time ("Your data", on the Data Update page: the complete referral history and the team's contact log, as CSV). On termination the same export is the handover, and deletion on request is the export in reverse: the deployment, its version history, and the call list are removed. Contractual timelines are in the services agreement.
The marketing site uses cookie-less, first-party page counting. The demo records sign-in times. No third-party trackers, no advertising pixels, no cookies.
samuel.putra101@gmail.com, answered by a person within one business day.
© 2026 Bellwether · Home · This page describes the demo deployment and the standard client configuration; a signed clinic's agreement governs where the two differ.