Products

Your data is protected.

By design.

Built entirely on Microsoft Azure’s HIPAA-eligible infrastructure. Every layer engineered for healthcare-grade security and regulatory compliance.

HIPAA

BAA Signed

AES-256 Encryption

U.S. Data Residency

Microsoft Azure

501(c)(3) Non-Profit

SOC 2 Type 2 and HITRUST CSF certification in progress.

Built on Microsoft Azure

Built entirely on Microsoft Azure's HIPAA-eligible infrastructure. AHI inherits Azure's HITRUST CSF, FedRAMP High, ISO 27001, ISO 27018, and SOC 2 certifications at the infrastructure layer.

Mission-aligned, not investor-driven. AHI is a 501(c)(3) non-profit. We don't sell your data because we don't have a business model that requires it.

Security Leadership

Dr. Zishan Merza

Chief Security Officer

PhD in Cybersecurity · 30+ years in security architecture, threat analysis, and enterprise infrastructure protection.

Dr. Merza leads security strategy and oversees every layer of AHI's infrastructure, from tenant isolation to AI firewalling. His work spans three decades of cybersecurity practice across enterprise systems, healthcare data environments, and government-grade threat analysis. At AHI, he owns the architecture that protects every encounter note flowing through the platform.

security@halai.ai

The Technical Architecture

Six layers of protection, wrapped around every encounter note.

What This Means For You

Your patients' data. Protected the way it should be.

Can other providers see my patients' data?

No. Your data lives in its own isolated environment. No other provider, practice, or organization can access your patients' information. It is completely separated from everyone else's.

Is this HIPAA compliant?

Yes. AHI is built on Microsoft Azure's HIPAA-eligible infrastructure with a signed Business Associate Agreement. The same infrastructure used by major health systems across the country.

Will my data be used to train someone else's product?

Never. Your encounter notes are never shared with other providers and never used to train external models. The only training your data powers is your own ENCOUNTERai pipeline, which learns your documentation style to write notes the way you write them.

What happens if I want to leave?

You request deletion and your data is completely removed. You own your data. AHI holds it, protects it, and gives it back or deletes it whenever you say so.

Do I need my IT department to set this up?

No. There is nothing to install, no EHR integration required, no IT cooperation needed. You upload your encounter notes directly. Your IT department and your EHR vendor do not need to be involved.

Where is my data stored?

United States only. Microsoft Azure data centers on U.S. soil. No third-party subcontractors. No offshore processing.

AI & Your Data

Your data trains your model. Nobody else's.

Your encounter notes are never used to train external models.
Your data is never shared with other providers or organizations.
The only training your data powers is your own ENCOUNTERai pipeline.
No conversation audio is recorded or stored.
You can request complete data deletion at any time.

AHI is a 501(c)(3) non-profit. We don't monetize your patient data. Our mission is aligned with yours.

Compliance At A Glance

Every layer, documented and auditable.

HIPAA Compliant

Signed BAA with Microsoft Azure. Physical, technical, and administrative safeguards validated through independent audits. HIPAA-eligible from day one.

Certifications

HITRUST CSF, SOC 1/2/3, ISO/IEC 27001/27017/27018, FedRAMP. Inherited through Azure's shared responsibility model.

Encrypted. Isolated. Yours.

AES-256 at rest, TLS 1.3 in transit. Each provider's data in their own isolated Azure container. Private Link network isolation.

AI Processing is Firewalled

Never shared with other providers. Never used to train external AI models. The only training your data powers is your own ENCOUNTERai pipeline.

BAA at Signup

Embedded in Terms of Service — same approach as Practice Fusion, Athena, Epic. You don't need a separate agreement with Microsoft.

You Own Your Data

Request complete deletion at any time. U.S.-based data residency. No third-party subcontractors. Microsoft Azure is the only infrastructure provider.

For IT, Security & Compliance Teams

Start your security review.

Request access to AHI's security documentation package including our BAA, data architecture overview, subprocessor list, and compliance questionnaire responses.

Request Security Package

Available on request BAA template · Data flow diagram · Subprocessor list · HECVAT response · Incident response summary · BC/DR overview

Healthcare-grade security. Not an afterthought.

Request Security Package View Terms of Service