GraphiteGraphite by Augsidius
Platform

Safety, privacy & intended use

Intended use

Augsidius provides clinical decision support and documentation assistance to qualified healthcare professionals, and health information and triage guidance to patients through products built by our customers. It does not diagnose, prescribe or replace professional judgement.

  • Clinician-facing outputs are suggestions for review. A qualified professional decides.
  • Patient-facing outputs (audience: "patient") never give a diagnosis as a conclusion or a medication dose, always include safety-netting advice, and always escalate red flags.
  • Severity, likelihood and certainty values are aids to prioritisation, not guarantees.

How we keep outputs grounded

  • Clinical statements are tied to concepts and graded evidence in the Augsidius Evidence Graph, with certainty labels on a GRADE-aligned scale.
  • When evidence is missing, the API says so instead of guessing: answers state what the evidence does not cover, unmatched text is returned unmatched, and codes are marked provisional until verified.
  • Text-processing models only use what is in your input and cite the spans they used.
  • Evidence is reviewed continuously; clinician feedback through the API triggers re-review of the evidence involved.

Your responsibilities

  • Show certainty labels and emergencies_open / red flags clearly to users.
  • Keep a clinician in the loop for any output that influences care.
  • Accept the patient-facing terms for projects that serve patients, and obtain consent from patients as required by law.
  • Do not use the API for emergency dispatch decisions without a human in the loop.

Data protection

  • No content stored by default. We keep request metadata (time, model, status, latency, units) for billing and support — not the request or response text. You can enable 30-day encrypted request logging per project for debugging.
  • No training on your data. Your requests are never used to train models. Feedback is used only as aggregated, de-identified signal about evidence quality.
  • India data residency. Production processing and storage for Indian customers is in India.
  • DPDP Act 2023. Augsidius acts as a data processor for the patient data you send. A Data Processing Agreement is available on request; deletion requests are fulfilled within 30 days.
  • Security. TLS everywhere, keys stored only as salted hashes, least-privilege access, audit logging of every administrative action.

Minimise what you send: use concept ids and observations rather than full records where you can, and run aug-deid on text that does not need identifiers.

Reporting a problem