Your patient’s data stays in your tenant.

Eve-Genesis (Clinical Edition) is the proprietary training corpus that fine-tunes our Phi-4 clinical reasoner. It contains between 100,000 and 250,000 structured clinical reasoning traces, generated synthetically from public clinical practice guidelines, published medical literature, and structured reasoning templates.

No customer data is used in its construction. No patient data is included. No protected health information is present. The corpus is not built from data belonging to the institutions we serve. This is enforceable by inspection of the dataset itself — the architecture cannot leak what is not present.

For institutional customers and their security teams: this is the strongest possible version of the no-customer-data-in-training claim. It is an architectural property, not a policy that can be revised under pressure.

ChironAI fine-tunes Phi-4 using LoRA (Low-Rank Adaptation) — a parameter-efficient method that adds small adapter layers to the base model rather than retraining its full weights. Phi-4 retains its general capabilities; the adapters add clinical-reasoning depth.

Practical implication: when Eve-Genesis (Clinical Edition) grows or we add specialty depth, we re-fit the LoRA adapters on the expanded corpus and ship updated adapters. The base Phi-4 weights stay stable. This is the modern, cost-efficient way to specialize a base model, and it also makes our training lineage auditable: every shipped adapter has a corresponding training-corpus snapshot.

ChironAI production data is hosted on Microsoft Azure in regions appropriate to the institutional customer’s residency requirements. United States customers are hosted in US regions by default. European customers can be hosted in EU regions. Customers with specific sovereignty constraints can elect deployment topologies matched to their jurisdictional requirements; we work with each institutional customer to confirm region selection during deployment scoping.

Customer data does not cross regional boundaries except as explicitly contracted (for example, multi-region replication for disaster recovery, with both source and replica in the same regulatory jurisdiction).

Retention for each data class is documented in the deployment Statement of Work for institutional customers. Clinical records follow the retention obligations of the customer’s jurisdiction — commonly seven years in the United States, longer in some specialties (pediatrics, OB-GYN), and per local statute elsewhere. Operational data (audit logs, usage metrics, security incident records) is retained for a minimum of seven years.

Eve-Genesis (Clinical Edition), being synthetic, is not subject to clinical-record retention rules — it is reference IP, versioned and snapshotted on the same quarterly cadence as the LoRA adapters that consume it.

Where the data subject has rights under applicable law (CCPA/CPRA in California, GDPR in the EU, UK GDPR in the United Kingdom, others elsewhere), ChironAI honors those rights through documented intake and processing workflows. Requests are routed to the institutional customer who is the data controller; we operate as data processor under a Business Associate Agreement and a corresponding data-processing addendum.

For institutional deployments handling Protected Health Information, ChironAI executes a Business Associate Agreement (BAA) with the covered entity. Our standard BAA template is available on request and is designed to be compatible with the BAA frameworks most US hospitals operate under.

For deployments in jurisdictions where BAA is not the applicable framework, we execute a Data Processing Addendum that maps the equivalent obligations.

Our infrastructure subcontractor is Microsoft Azure, contracted under Microsoft’s HIPAA Business Associate Agreement. The frontier reasoning model vendors named on our Technology page (Anthropic Claude, OpenAI GPT, Meta Llama) are accessed under enterprise contracts that include data-processing terms appropriate to regulated workloads; specific contract terms are available to institutional customers under NDA.

No frontier reasoning model vendor receives PHI; clinical queries are routed through our orchestration layer with appropriate de-identification for any path that touches a third-party model. Where customer policy prohibits a specific vendor entirely, that frontier slot can be swapped out of the F5/reasoner stack without rebuilding the agent.

This site (chirongrid.ai) is a marketing surface. It does not collect, process, or store Protected Health Information. The Privacy Policy that governs this site is a marketing-surface Privacy Policy.

The production SaaS applications (cds.chirongrid.ai and om.chirongrid.ai) are separate surfaces operating under separate customer agreements. Those agreements include the BAA terms, the data-processing addenda, and the specific deployment-scoped data-handling commitments that govern PHI use.

The substantive customer-facing terms governing institutional use of ChironAI™ products are set forth in the customer agreement, which controls to the extent of any conflict with the marketing-site Privacy Policy.