AI with safety
AI that helps people understand the visit, with guarantees you can test
The AI in EDFlow explains the visit, never the medicine. Facts always come from the hospital's data; the model only chooses what to show and how to phrase it for staff, and patients only ever see reviewed wording.
At a glance
Deterministic facts
Stages, estimates, names and test states come from the same data as the rest of the app, never from the model.
No free prose to patients
Patients and families see cards and reviewed phrases chosen by id. Any free text a model writes is discarded.
Humans take actions
Anything that reaches another person is approved by a human. Safety alerts are deterministic.
Zero data retention
Allow-listed providers, no retention, no training on prompts, and a kill switch for every feature.
Facts first. Staff in control.
Facts come from hospital data. Staff approve messages. One setting turns every AI feature off.
PrivacyWhat AI never does
- Show, infer or explain results.
- Diagnose, triage, rank urgency, or give medication or eating and drinking advice.
- Promise a time.
- Write free prose to a patient or family member.
- Contact staff or patients on its own initiative.
- Stand in for an emergency path: "I feel worse" always works exactly as it does without AI.
What AI does, and for whom
| Who | What it helps with |
|---|---|
| Patients | "Where am I, what's next, how long, who's looking after me", answered with live cards; needs turned into the same structured requests, after the patient confirms; approved explainers for tests; translation beyond English and French after review |
| Families | A "since you last looked" summary built without a model, and practical answers about parking, visiting and how the department works |
| Nurses and physicians | A digest of the request queue and a handover summary whose selection and order are deterministic; help writing short updates in the patient's language, sent only after staff approve |
| Charge nurses and managers | "Ask your data" with charts and tables, bottleneck narratives, weekly report drafts and anomaly alerts |
| Integration teams | A mapping assistant for HL7 v2, FHIR and CSV samples, validated against the event schema, and a documentation assistant |
Eight guarantees, enforced by tests
- Facts come from the data, not the model. Anything about the visit appears in a card filled by the server from the same projections as the rest of the app.
- The model sees references, not people. No names, dates of birth, identifiers or tokens are sent; names are replaced by pseudonymous references and restored afterwards.
- Tools run as the caller. A patient's tools can reach only that patient's visit.
- Distress is caught before any model runs, by a deterministic lexicon on the device and on the server.
- Patient and family wording is selection-only, and every other output passes guards for banned and reassuring words, result interpretation, promises, ungrounded numbers and names.
- Only zero-data-retention providers are called, with prompt training disallowed and an allow-listed provider set.
- One switch turns every AI feature off, and every screen still works without AI.
- Every prompt or model change passes evaluation gates before release.
Regulatory position and transparency
EDFlow is communication and workflow software. Health Canada's guidance places software that doesn't diagnose, treat or interpret clinical data outside the medical device definition, and the AI features are designed to stay there: no results, no triage, no clinical advice.[1]
Every AI message carries an "AI" label, machine translation carries a badge and a way to see the original, and patients are told what the assistant can see, that it can be wrong, and how to turn it off. Quality and usage are measured per language and age band, so the features work as well in French as in English.
Frequently asked questions
Can the assistant give medical advice?
No. It never shows, infers or explains results, never diagnoses or triages, never gives medication or eating and drinking advice, and never promises a time. Questions like these are answered with a request to the care team.
What if a patient types that they feel worse?
The same thing that happens without AI. Distress typed into the assistant produces the in-person instruction before any model runs, and the "I feel worse" button stays on screen. When self-harm is mentioned, a deterministic safety layer, not the model, alerts the care team.
Can we turn AI off?
Yes. One switch turns every AI feature off within one round trip, for a site or for the whole platform, and every screen keeps working without AI. A patient can also ask staff to turn AI off for their visit.
Does patient data leave Canada for AI?
Only features whose data can stay de-identified run for hospital tenants at first. Features that would send visit context to a model run only after the hospital's privacy office accepts US processing under zero data retention, with a written agreement chain to every provider.
A connected visit for everyone.
Bring the whole visit into view.
Explore the patient and staff experience, then plan a pilot around your department’s workflows.