Last updated August 16, 2026
The most common question a resident asks about any tool is: will my program's compliance office kill it? Here is the plain answer, and the architecture behind it — a page you can forward to your program director or GME office.
Tomo's servers do not receive, store, or transmit Protected Health Information (PHI). Tomo is not a HIPAA Business Associate. The product is architected so that patient-identifying data never reaches our backend — this isn't a policy promise layered on top, it's how the system is built.
Tomo handles only procedure-level content: operative technique, attending preferences and pearls, danger points, and template structure. It is designed to never hold patient identifiers — no names, MRNs, dates of birth, contact information, or clinical history tied to a person — in any field, form, upload, or prompt.
You connect your own Notion workspace, and your case log lives there, under your control. When the app needs to read it, the request passes through a Tomo proxy that forwards bytes from Notion straight back to your browser. That proxy never logs, caches, persists, or inspects the response — the content flows client → Notion → client and is never written down on our side.
A closed, opt-in set of procedure-level workflows can send text to our AI provider to help draft templates and structure your own notes. Every such request passes through an automated redaction step before it leaves, is gated behind a feature flag, and records only a metadata-only audit entry (token counts and latency). We do not log the prompt or the response, and these workflows are scoped to technique and decisions — never “tell me about the patient.”
All traffic is encrypted in transit (HTTPS). Authentication is handled by Supabase; billing by Stripe (we never see card details). Any credentials you choose to connect are encrypted at rest. Access to our systems is limited to what's needed to operate the service.
We rely on Supabase (auth + database), Vercel (hosting), Stripe (billing), Resend (email), PostHog (count-only analytics), Anthropic (the de-identified AI workflows), and your own Notion workspace. See our Privacy Policy for details.
We say “PHI-safe by design” — not “HIPAA-compliant” — on purpose. HIPAA compliance is a property of a covered entity's or business associate's whole program; Tomo's claim is narrower and more precise: because our servers never receive PHI, Tomo is not a Business Associate and there is no PHI for us to safeguard on your behalf. Keeping patient data out of Tomo is a shared responsibility — the app is built to prevent it, and you agree not to enter it (see our Terms).
If your GME or compliance office has questions, email rserbin15@gmail.com and we'll respond directly.