Security, plainly.

Through one dedicated workstation, with Splashtop Business: the same category of remote-access software IT providers and clinics already use. A small app runs on that workstation; we connect from our own computer with our own named login and two-factor. Nothing for your team to install beyond that app.

No. The app only makes outbound connections, like a browser.

No. We can reach that one workstation, nothing else. There is no network tunnel into your office.

Named people only, with two-factor on our account. Every session is logged on our side: who, which computer, when.

Yes. Splashtop logs every session. The agent keeps its own action log on the workstation, and it works under its own login in your software, so every action it takes is attributable to it and only to it.

No. The screen stream and keystrokes are encrypted end to end; Splashtop transmits them but does not store them. In their own words, Splashtop “does not process, store, or have access to any of the users’ computer data such as patient data or medical records.”

Splashtop states it never accesses the data, which is the same position your internet provider is in. Our business associate agreements are with the parties that do touch data: with you, and with AWS for the document-reading step.

Good. We send a one-page install note, this page, and Splashtop’s own security documentation. Your IT can inspect the app and remove it whenever they like.

The agent runs on your own workstation, inside your software. One step leaves it: reading a document, which runs on AWS Bedrock under a business associate agreement. Bedrock does not store the content or use it to train models. Run logs stay on your workstation, in your own systems.

Only what the one decision needs: the document being read and the question about it. Not the chart. Not the history. The call is logged (who, when), not the content.

The remote-access app, a browser, and our agent, under its own local user. Passwords live in the operating system’s protected store (Windows DPAPI or macOS Keychain), never in a file, an email or a chat message.

No. It keeps running whether or not anyone is connected, and reports status and counts to our side over ordinary HTTPS. Status and counts only.

The Site runs no advertising trackers, no analytics scripts, and no social-media pixels. We collect information only when you give it to us: the discovery form, the booking calendar, or an email. The Privacy Policy has the rest.

Every action is read back from the screen before it counts. A click we can’t confirm is a click that didn’t happen. When it can’t prove something, it stops and asks a person.

The rulebook is yours, written in plain sentences. Sumvant follows it. It does not improvise around it. Only your team changes a rule.

It works real items while we watch and your team reviews the results. Every action read back; every exception explained. Nothing runs alone until it has earned it.

We reach one workstation, with a named login and two-factor, and every session is logged. No ports opened, no tunnel into your office.

Run logs stay on your workstation, in your own systems. The one document-reading step runs under a business associate agreement and is not stored.

There is no such thing as a HIPAA certification, and we do not claim one for ourselves or for our tools. We sign business associate agreements where health information is involved, and we hold one with AWS for the document-reading step.

Uninstall the remote-access app, or disable the agent’s login in your software. Either stops us immediately. We also give you a one-page offboarding note before go-live.

Work we do for clients is governed by the written services agreement, and where health information is involved, a Business Associate Agreement, signed with each client. The run logs were on your workstation all along; they stay with you.

You can ask us at any time to tell you what information we hold about you, correct it, or delete it. Email [email protected] and we will respond within 30 days.