AI safety brief
A short, dense reference for privacy officers and clinician advisers. The constraints below are technical, not promises. Print it, circulate it, attach it to your procurement pack.
It looks up, summarises, and drafts. It never signs a MAR cell, gives a medication, holds or refuses a dose, or changes a chart. Every clinical write still flows through the audited workflow your auditor already approved.
Records are stored only in ISO 27001 data centres in Sydney and Melbourne. AI inference runs in-region under a written Data Processing Agreement that prohibits training on your prompts.
We log every prompt, every tool call, every value each tool returned, and the card the user actually saw, with user, participant, and shift context. Retention matches your clinical audit log. Your compliance officer can replay any session.
AI is a per-tenant feature flag, a per-role permission, and a per-participant opt-out. Run it fully off, on for coordinators and supervisors only, or on for everyone with specific participants excluded. The opt-out is recorded in the audit log.
Our privacy policy states it plainly: CareLedger does not provide healthcare services, medical advice, clinical decision support, diagnosis, prescribing guidance, or medication recommendations. The assistant does not change that. It is on our list of things the assistant is never used for:
Dose math, allergy checks, interactions, PRN authorisation, and alarms all run on validated, deterministic engines inside CareLedger. The assistant can surface their result; it cannot replace them. Read the full privacy policy →
If a card looks wrong
Open the audit tab and find the session by user, participant, or time.
Replay the receipt: the exact prompt, the tool called, and the fields returned.
Compare against the MAR, which is the source of truth and was never written by the assistant.
If a clinical entry was made in error, correct it in the MAR through the normal append-only workflow; the original entry remains in the audit trail.
Use "report this card" to flag the rendered card for review by your CareLedger contact.
Assistant changelog
A dated, append-only record of what changed in the assistant itself.
Added "what changed since last handoff" card.
Removed "suggest dose" preview after clinician-adviser review. Decision logic moved fully into the deterministic rules engine.
First pilot: shift-handoff card, read-only, behind a feature flag. Two pilot organisations.
We will walk your privacy officer through the PHI boundary and share the assistant audit-log format.