N1.care gives patients and their clinicians one place for health records, lab results and AI-assisted reports. Security policies, architecture and incident response documentation are available to evaluators under NDA.
Last updated
The regulations N1 works under, the role N1 takes in each and the agreement that covers it.
HIPAA Privacy, Security and Breach Notification Rules
N1 Research, LLC signs a business associate agreement with each covered entity or business associate it serves. Written security and privacy policies set out how N1 protects PHI.
FTC Health Breach Notification Rule
For these accounts N1 is a vendor of personal health records under the FTC rule. After a breach of their health data, N1 notifies the affected patients within 60 calendar days of discovery, and notifies the Federal Trade Commission and, where the rule requires, the media.
EU GDPR, UK GDPR and Swiss FADP
N1 acts as processor under a Data Processing Addendum that sets out the processor terms the GDPR requires.
Public documents download directly. Restricted documents are emailed to you after you confirm your work email and sign the NDA. The BAA is accepted in the N1.care app.
Every company that processes customer data for N1, what it does, where it operates and the agreement that covers it, with the regions available for uploaded files.
Which AI providers N1.care uses, what data reaches them and where it is kept.
The confidentiality terms you accept online before N1 emails you its restricted documents.
N1's standard BAA for U.S. covered entities and business associates.
N1's standard processor terms, with the EU Standard Contractual Clauses and the UK Addendum for international transfers.
The security and privacy policies N1 Research, LLC operates under, with the schedule of recurring reviews, tests and training.
The most recent evaluation of N1 Research, LLC's safeguards against its policies and the HIPAA Security Rule.
HIPAA requirements mapped to the N1 policy clauses that address them.
How the platform is built: hosting, network paths, identity and authorization, data stores, AI routing and the controls around each.
How N1 detects and handles incidents, notifies customers and patients, and backs up and restores the platform.
Companies N1 uses to provide N1.care.
Customers under the Data Processing Addendum receive 30 days' notice before a new subprocessor is added.
| Company | Purpose | Data | Location |
|---|---|---|---|
| N1 Research Sdn. Bhd.Group company that builds and operates the platform · Subcontractor BAA | Builds and operates the platform for N1 Research, LLC | Access to production systems, including PHI, for support, incident response and maintenance | Malaysia |
| Google LLC (Google Cloud)Cloud hosting · Google Cloud BAA | Hosts the production platform: compute, databases and file storage | Production application data, database records and uploaded files | United States; uploaded files in the region chosen for each patient |
| Google LLC (Google Cloud Vertex AI)AI models · Google Cloud BAA | AI models on Vertex AI | Prompts and documents sent to these models, including health data | Global (Google Cloud) |
| OpenAI OpCo, LLCAI models · OpenAI BAA | AI models through the OpenAI API | Prompts and documents sent to these models, including health data | United States |
| Cloudflare, Inc.Network edge | Network security and delivery for platform traffic | Network traffic in transit; content is not stored | Global network; headquarters in the United States |
| Google LLC (Google Workspace)Workforce email and documents | Corporate email and documents | Workforce identities and corporate email and documents only; no PHI | Google data centers worldwide |
| Stripe, Inc.Payments | Subscriptions and payments | Customer billing and subscription data only; no PHI | United States |
Each patient's uploaded files stay in the region chosen at registration. The choice is permanent. Databases and logs are hosted in the United States for every patient.
| Region | Location |
|---|---|
| United States | United States |
| European Union | Frankfurt, Germany |
| United Kingdom | London, United Kingdom |
| Singapore | Singapore |
| India | Mumbai, India |
| Australia | Sydney, Australia |
N1 Research, LLC, a Delaware company, signs all customer agreements and holds the cloud accounts. The platform is built and operated by a group company in Malaysia under a Subcontractor BAA.
Only specific N1 staff can access production systems, and they use them for support, incident response and maintenance. They view patient data only inside N1 systems.
Sign-in and access stop at once. N1 then deletes the patient's files in every region, their database records and their sign-in identity. Patients can also delete individual files at any time.
AI models read patient documents to produce reports and answer questions in chat. Requests that carry PHI go only to OpenAI or to models hosted on Google Cloud Vertex AI, both covered by a BAA. Prompt and response content is not written to N1's logs. PHI is never sold or used for marketing, and is not used to train AI models.