SHMEL
Only send what’s needed.
A reactivation email doesn’t need a whole patient record. The request carries the context the job needs, nothing more.
Security at SHMEL
Your patient data shouldn’t become AI data.
Security doesn’t start at the AI provider. It starts before the model ever sees the request — SHMEL builds every request from only what the job needs.
Clinic record made up
- NameMaria Johnson
- Date of birth04/22/1987
- Payment•••• 4831
- TreatmentBotox
- Last visitJune 4
Sent to the model
Waiting for the gate…
- Patient ID7F21
- TreatmentBotox
- Last visitJune 4
3 fields blocked · logged
An illustration, not a fixed list: which fields a job may use depends on the job.
We protect your data before the AI sees it.
Most AI security explanations start with the model provider. Ours starts earlier: every model request is built by SHMEL’s own privacy controls first.
Some data doesn’t get through.
Fields the job doesn’t need are stripped before the request is sent — not filtered out of the answer afterwards.
Every field needs permission.
Ask for something a workflow isn’t permitted to see and the request doesn’t go.
Where we stand, on one page.
Security vendors love badges. We would rather tell you exactly what is in place and what is not yet.
In placeBusiness Associate Agreement
Available, and signed before any patient data moves.
In placeNo training on your data
Nothing from your practice trains general-purpose models. Our model contracts carry no-training terms.
In placeEncryption
In transit and at rest, today.
In placeRole-based access
People reach only what their job needs, and staff access is logged.
In placeModel requests logged
Every request is recorded with its workflow and the fields requested, approved and blocked.
In placeHosted in the United States
Patient data is deleted thirty days after an account ends. Compliance records are kept six years. Export any time.
In placeModel provider
Anthropic models via Amazon Bedrock, behind SHMEL’s own privacy layer.
In progressSOC 2 Type II
In progress. We do not hold it yet, and we do not claim that we do.
ScheduledPenetration test
Scheduled, not yet completed.
“HIPAA certified” is not on this page
There is no official HIPAA certification. What exists is a Business Associate Agreement and the controls behind it — which is what we offer, and what is worth asking any vendor for.
If something goes wrong
Under the BAA, if we discover a breach requiring notification, we tell you without unreasonable delay. Report a security issue to security@shmel.ai — acknowledged within one business day.
So what can go to an ad platform?
Patient dataStays out
NameTreatment historyPatient recordIndividual identifierPatient list
Stays in SHMEL
Stays in SHMELMarketing performanceCan go
Campaign performanceAggregate resultsApproved content
Your ad accounts
Your ad accountsNeed to send this to IT?
We’ll answer the questions directly.
Security questionnaire
Send it over. A founder will complete it — we are small enough that it will not sit in a queue.
Sub-processor list
Named vendors available on request under NDA, always before you sign.
Security questions
Technical details
EncryptionIn transit and at rest. In place.
Access controlRole-based. Staff access logged.
Hosting and residencyUnited States.
Retention — patient dataLife of the account plus thirty days, then deleted.
Retention — compliance recordsSix years.
Export and deletionExport at any time; earlier deletion on request.
Sub-processorsCloud hosting, model inference, transactional email and SMS, error monitoring, payments. Notice given before adding one that can handle PHI.
Model providerAnthropic models via Amazon Bedrock.
What reaches a modelRequests are built by SHMEL’s privacy layer from the attributes that workflow is permitted to use.
Model request loggingModel requests recorded with the workflow and the fields requested, approved and blocked.
Model trainingNo training on customer data. No-training terms with model providers.
BAAAvailable, signed before any data moves.
SOC 2 Type IIIn progress. Not held, and not claimed.
Penetration testScheduled. Not yet completed.
Breach notificationUnder the BAA, without unreasonable delay.
Vulnerability reportingsecurity@shmel.ai, acknowledged within one business day.
Still have a security question?
Good. Ask it before connecting patient data. Need a security questionnaire completed? Send it over — a founder will answer it.