Security
The strongest security control is a capability that does not exist.
MyWholeFile MD is read-only, holds no clinician credentials, and never hands a health record to an AI assistant that the patient has not explicitly connected. Most of what follows describes things the system cannot do rather than policies we promise to follow.
Credentials and access
Three separate credential systems that never meet.
Your login to us, your authorization at your clinician's portal, and any AI assistant's authorization to read your record are kept entirely separate. A weakness in one does not become access through another.
We never see your portal password
Authorization happens on your clinician’s own portal. We receive a scoped, revocable token afterward and never the credentials you typed.
Tokens never leave the backend
Access tokens for your health record are encrypted at rest and are never sent to your browser, to an AI assistant, or to any third party. Assistants receive answers, never keys.
Least privilege by request
We request only the categories of record needed to answer questions about your health, and deliberately do not request insurance coverage or information about family members.
Revocation is immediate and yours
You can disconnect a practice or an assistant at any time without contacting support and without your practice’s involvement.
How the system is built
Isolation, encryption, and an audit trail that cannot be quietly edited.
Encryption throughout
Records are encrypted in transit and at rest. Sensitive credentials are additionally encrypted with per-record keys, so database access alone does not yield usable tokens.
Tenant isolation enforced at the database
Separation between practices and between patients is enforced by the database itself rather than by application code remembering to filter. A missing check fails closed.
Tamper-evident audit logging
Every access to a health record is logged in a hash-chained trail, so any later alteration to the history is detectable rather than silent.
No third-party scripts where records live
The application, the API, and the assistant connection carry no analytics, advertising, or session-replay scripts of any kind. Marketing measurement exists only on this public site.
Reporting
If you find something, tell us.
We welcome reports from security researchers and will not pursue legal action against anyone acting in good faith who reports a vulnerability to us privately and gives us a reasonable opportunity to fix it before disclosing.
This page describes our security design. It is not a certification. See our subprocessor list for the vendors involved in operating the service and the agreements we hold with each.