DATA GOVERNANCE & SECURITY
Built on practical protection, not legal assumption.
Laws can be ignored. Enforcement is uncertain. Kushé's patient data protection rests on five overlapping practical layers: technology controls that prevent unauthorized access regardless of intent, human accountability structures, and architectural decisions that limit exposure at every point.
Kushé does not sell, share, license, or transfer individual patient records — identified or de-identified — to any third party for any commercial purpose. Analytics subscribers access aggregate, population-level statistics only. No patient-level record or identifier is ever included in any external report, export, or API response.
Individual Identifed Records
Accessible only to authorized clinicians at the treating facility, and client institution administrators, where formally agreed. Never sold. Never transferred. Never used commercially.
Encrypted at every layer
Designed to be encrypted at every layer . Local device database encrypted with SQLCipher. Data in transit via TLS 1.3. Data at rest via AES-256..
Never sold, Never licensed.
What Kushé will never do.
Never sell individual patient records to any party for any purpose. Include patient-level data in any commercial product. Use patient data to train AI models without explicit consent. Allow data to be used for advertising, marketing, or profiling.
Your Data, Your Decision
Your data stays yours. Your decisions stay yours. Nothing is moved or shared without your institution’s written approval. We do not sell your data—ever.
Immutable audit trail
Every record access action is logged permanently. No application user can delete audit entries.
Patient rights
Every patient can request a copy of their record.