Security evidence and responsibilities
Current status
EchoReview is a workflow evaluation platform. AI is in development and research-only. This page does not assert HIPAA compliance, regulatory clearance, SOC 2 attestation, ISO certification, or executed provider BAAs. Infrastructure eligibility alone would not establish application compliance.
Application controls to test
The app includes workspace membership, role controls, sign-off records, correction trails, and audit features. Verify authorized access, image delivery, isolation, offboarding, session handling, MFA requirements, and logging against the hospital’s own acceptance criteria.
Hosting and processing
The application uses Lovable Cloud for accounts, database, and storage, and Cloudflare Workers for application hosting. Confirm actual processing regions, encryption settings, retention, backups, restoration tests, contracts, and support arrangements before approving patient data. No specific encryption version, key rotation, certificate pinning, or hosting region is asserted here.
Recipients need a verified inventory
Current research analysis uses hosted AI through Lovable AI Gateway. Include it, application hosting, storage, authentication, and email delivery in a verified recipient and subprocessor inventory. Confirm provider identity, purpose, region, retention, and contractual coverage; this page is not a complete verified inventory.
Routine workflow excludes experimental AI
Routine uploads and connector deliveries do not invoke experimental AI, and reporting excludes historical AI findings and AI-seeded drafts. Separate administrator research benchmarks remain available. Verify the approved data flow before a hospital patient-data pilot. No AI result may guide clinical decisions or urgency.
Responsibilities to agree
EchoReview and the site must document access administration, permitted data, support, incident response, retention and deletion, vendor oversight, and recovery duties in approved agreements. The hospital retains clinical interpretation, credentials, reader availability, and escalation responsibility.
Security questions
Contact contact@echoaireview.com to discuss security evidence or report a concern. Do not include patient data, passwords, or access tokens. Required agreements, independent tests, and operating procedures must be reviewed rather than inferred from this page.