Security and privacy designed from the architecture

We design Myukura following a simple principle: each component should only access the information it needs to perform its function.

This shapes the architecture from the professional’s access through to audio processing, documentation generation and subsequent storage.

The measures applied on the platform include:

The audio of a consultation is one of the most sensitive elements of the workflow.

That is why Myukura is designed to separate processing from retention of information.

When a workflow needs audio to produce a transcription, the aim is to keep it only for the time necessary to complete that processing and to prevent it from automatically becoming a permanent clinical file.

Specific retention policies may vary depending on the product, the configuration and the deployment environment.

The resulting clinical documentation follows a different life cycle from the audio that gave rise to it.

Not all data needs to take the same path.

Myukura is developing an architecture capable of combining cloud processing with local processing depending on the function, the technical requirements and the environment of use.

The security of a clinical system does not depend only on preventing unauthorised access.

It also depends on controlling what happens to the information produced by artificial intelligence.

Myukura is designed under a human in the loop approach.

Systems can help transcribe, identify and structure information, but the clinical documentation generated must remain subject to professional review before being considered final.

This makes it possible to treat model errors as an explicit part of the system, rather than as a possibility hidden from the user.

We do not assume a model is reliable simply because it has obtained a good public score.

We develop and evaluate specialised components to understand their behaviour in the specific functions for which they are used.

This includes studying:

• accuracy;
• errors;
• behaviour with relevant clinical information;
• latency;
• computational requirements;
• ability to run locally;
• and oversight mechanisms.

Security also means knowing a system’s limits.

Certain platform operations may generate technical and audit logs needed for security, diagnosis and traceability.

These logs are designed following minimisation criteria and must not be used as a parallel mechanism to store clinical content unnecessarily.

No responsible organisation should claim that an incident is impossible.

Our approach is to work to prevent them, detect them and have procedures in place to respond when they occur.

When an incident involves personal data, its nature, scope and risk to the people affected are assessed, and the communication and notification obligations set by the applicable regulations are followed.

Working with healthcare technology means making privacy decisions long before writing a legal policy.

The principles that guide our architecture include:

Myukura uses specialised infrastructure and technology services to operate different parts of the platform.

Not all providers are involved in all products, and not all workflows use the same architecture.

We keep up-to-date information on the categories of providers that may take part in processing information and the functions they perform in our Trust Center and privacy documentation.

Myukura is in development.

Our security controls, architecture and procedures evolve together with the product.

We do not use certifications, audits or security tests as a commercial argument until they have actually been completed and we can document them.

As we introduce new controls or independent assessments, we will update this page and the Trust Center.

If you are a researcher, user or technical professional and believe you have identified a vulnerability related to Myukura, we want to hear about it.

Security contact: seguridad@myukura.com

Please do not include real clinical data or sensitive personal information in the first message.