A carrier using any system in underwriting carries the regulatory obligation for it. The vendor does not. That shapes what we build: every finding arrives with the evidence a reviewer would ask for, in a form that can leave our system and enter yours. Compliance you can describe but cannot export is compliance you cannot use.
Every assertion resolves to the region of the record it came from. A finding without a source is an opinion, so nothing unsourced reaches a decision-maker. A reviewer checks the reasoning rather than trusting it.
A case is built to re-run to identical output, with the model, the rules, the criteria library and the suppression policy all pinned to the versions that produced the original. Last quarter’s case is designed to produce last quarter’s answer, not a better one.
The log is built to be tamper-evident, using cryptographic methods, and designed for third-party verification. What was read, what was concluded, and what was suppressed are all recorded.
image fails or the record does not support a conclusion, the system says so and the case routes to your traditional path. A thin file stays thin. It is not rendered clean.
Output is structured so it can be assembled directly into an adverse action file, without a separate reconstruction step and without anyone going back to the record to work out why.
Each of the above produces an artifact you can export. The evidence trail, the replay record, the log, the abstention and the suppression record all leave our system in a form your own reviewers, auditors and regulators can read.
Reading a full record surfaces material that cannot lawfully be used in underwriting, and the rules differ by jurisdiction. Suppression runs from a versioned policy store rather than logic scattered through a pipeline, and every suppression is logged with the governing authority and the policy version that applied. That record exports separately.
None of this is added afterward. The ordering is the architecture: a deterministic clinical model does the primary work, and AI is applied last, on top of that structure rather than in place of it. That ordering is what makes the output defensible under model risk review.
Medical records are the most sensitive category of data a carrier handles. What follows is what we can state plainly, with nothing described as finished before it is.
Gesund is a HIPAA business associate and operates under a Business Associate Agreement with each customer.
SOC 2 is in progress with an independent auditor.
Gesund runs on AWS and Snowflake. Both are named deliberately: a carrier evaluating a vendor's ability to hold health data safely is entitled to know it sits in a mature, deliberately chosen environment rather than something bespoke.
Where a data set is cleared for one purpose, the constraint is enforced technically on our side rather than left to process. A corpus cleared for an experience study is not automatically cleared for anything else.
Gesund does not own a provider network, does not sell records, and does not resell your data. Your existing evidence vendors stay where they are. We interpret what you provide.
The audit log is built to be tamper-evident and designed for third-party verification. What was read, what was concluded and what was suppressed are recorded. See Governance.
We’ll return the structured clinical picture, every finding linked to its source, and you can check it against what your underwriters found.
Bring us a file