Built to hold as little of your data as possible.
You handle protected health information every day — so you know the questions to ask. Here's exactly how Occlara treats your data, what we minimize, and our honest roadmap to HIPAA-grade controls. No hand-waving.
What we do — today
Identifiers are minimized server-side before any AI call. Reconciliation runs on CPT codes, RVUs, and dollars — not patient identity.
Your uploads and the data derived from them are encrypted end-to-end through our infrastructure providers.
Every row is scoped to your account with Postgres Row-Level Security and least-privilege access. Your data is never comingled with another physician's.
Nothing enters reconciliation until you confirm it. Low-confidence extractions are quarantined for your review before they ever count.
We don't sell your data, and we don't use your documents to train models. Export or delete on request.
Subscription billing never receives procedure or clinical detail — we bill a flat SaaS seat, and nothing clinical touches the payment processor.
Where we're headed — and where we are
Occlara is engineered for HIPAA-grade controls from day one, but we'll be candid: we are in private beta and are not yet operating as a HIPAA-covered system of record. Before we handle protected health information at scale, we execute Business Associate Agreements (BAAs) with the subprocessors below and enable their HIPAA controls. Until then, we keep the product deliberately PHI-light and onboard every early user by hand.
| Subprocessor | Role | BAA / HIPAA posture |
|---|---|---|
| Supabase | Database · auth · file storage | BAA available on Team + HIPAA add-on — executed before PHI. |
| Vercel | Application hosting · serverless | BAA available on Pro — executed before PHI. |
| Anthropic (Claude) | Document extraction (AI) | BAA available on Enterprise — executed before PHI; inputs minimized. |
| Stripe | Subscription billing | No BAA — used PHI-free by design; never receives clinical detail. |
Private beta · hand-onboarded · numeric-first extraction with identifiers minimized before any AI call. We'll update this page as each BAA is executed and each control is turned on — so you can see the roadmap become reality, not just a promise.
What Occlara is built on
Transparency over black boxes. These are the technologies behind the product and the role each one plays.
What Occlara is — and isn't
An informational reconciliation tool that shows, in dollars, where your credited wRVUs and pay diverge from what your performed procedures should have earned against the CMS fee schedule.
Legal, billing, or compensation advice; your employer's system of record; or a filing or appeals service. What you do with the numbers is your call.
Last updated: July 2026. This page describes our engineering approach and roadmap; it is not a compliance certification or legal advice. Formal Terms and a Privacy Policy accompany general availability.