Fatu / Expe AI, Inc.
Security and data handling
Your hospital needs to know who can access documents, how AI processes them and which evidence supports each review.
LGPD compliance
Fatu processes personal data in compliance with Brazil’s General Data Protection Law (LGPD). Access to data and documents is restricted to authorized people, with security controls and traceability.
SOC 2 and HIPAA
Our security approach considers SOC 2 criteria and HIPAA requirements when defining controls and processes.
Hospital-scoped access
Access to data and documents is tied to the hospital organization and authorized user membership. The platform requires two-factor authentication and checks permissions before providing access to private files.
Hospital integrations use authorized queries limited to a defined scope. Reading data from a source system is separate from the hospital team’s review and approval of the packet.
Originals, versions and decisions
Fatu preserves original documents and retains the data and packet versions used in preparation. Issues and team decisions stay linked to the case so staff can check the source evidence.
Approval refers to a specific version. Changes to data or documents require another review. Fatu submits the claim to SUS after your team’s approval.
Data flows for AI
OCR text extraction may send the original PDF to AI providers. We therefore do not assume that personal information has been removed from every document before processing. Personal data detection and redaction occur at a later stage, and the output requires review before sharing.
OCR uses OpenRouter with routing restricted to Azure and requires zero data retention at the provider, without fallback to other providers. Rejection reason classification uses Jev/TypeSafe and has its own data flow. OCR controls do not establish the policy for every other AI service.
Zero data retention at the OCR provider does not mean deletion of originals, text or history retained by Fatu. These records support operations and case review. The hospital must assess the complete data flow and applicable terms before authorizing clinical data processing.
Review before implementation
The hospital’s review needs to cover required data, permissions, providers and subprocessors, processing locations, retention and deletion terms, and each party’s responsibilities. Request this information for assessment by your IT and privacy teams.
Technical controls are part of this review. Clinical data processing scope and terms need to be defined with each hospital and recorded in the documents applicable to implementation.
Security and privacy contact
For questions about data handling or information for your hospital’s review, email contact@fatu.app. Describe the topic without attaching medical records, clinical documents, credentials or other patient information.
The website privacy policy covers details submitted through the commercial interest form. It is separate from the review of clinical data handling on the platform.