In the United States, in a data plane for protected health information that is isolated from identity and billing. Every access to it is audited row by row, and de-identified projections feed everything else, such as analytics. Clinical text is processed by the AI model providers the grading engine calls, and burna.ai/subprocessors lists every category of subprocessor, its purpose and whether it can reach PHI. Your EHR and EDC credentials stay with you, and every record is scoped to your organization. Burna AI signs a business associate agreement with customers and is built for HIPAA and 21 CFR Part 11.