HIPAA-compliant · Clinician-owned data · Physician-directed AI
DrCurbside is a secure, HIPAA-compliant Large Language Model (LLM) chat with document editing and an AI scribe — built so that the people who use it are the people who decide where it goes. Your license, your data, secured.
Everything runs inside a HIPAA-compliant environment scoped to your practice.
A frontier-model curbside consult you can actually put Protected Health Information(PHI) into: Differentials, dosing questions, guideline reasoning, letters of medical necessity, FMLA documentation, and more. Secured under a Business Associate's Agreement where you explicitly own your data.
Drop in the 40-page consult packet, the payer denial, the discharge summary, the PDF of a trial. Ask it questions, then have it draft the appeal, the referral, or the patient instructions back out.
Ambient documentation that produces a note you'd sign — in your format, with your habits — and then deletes the audio on the schedule you set, not the schedule that suits a model roadmap.
The infographic
The tools already in your workflow are not just tools. They are collection points. Follow the same encounter down both paths.
How a single visit becomes someone else's model.
You and your patient talk. You examine, reason, decide. That reasoning is the scarcest input in medicine — and it is being recorded.
The EHR holds the record. The ambient scribe holds the conversation. The reference tool holds your questions. The inbox assistant holds your replies. Each one is a separate vendor with its own terms.
Strip the 18 identifiers named in HIPAA's Safe Harbor method and the data is no longer protected health information. HIPAA stops applying to it. So does most of your say in what happens next.
De-identified records pool across hundreds of health systems. A competitor's dataset alone spans de-identified records for more than 300 million patients and 16.3 billion encounters contributed by 310 health systems.
A competitor's models were pretrained on 118 million patients and roughly 115 billion discrete medical events to predict what happens to a patient next. Ambient-scribe vendors likewise train on de-identified encounter data. That capability was assembled out of your documentation.
The model returns as triage, drafting, prior-auth, and prescribing products. In parallel, model bills and state waivers work to license the software directly, so it can act without a physician in the loop.
The capability was assembled out of clinical work, and it is directed by people who don't hold a license and can't be held to one. Control over the practice of medicine moves from the people who carry the risk to the people who hold the data.
Same work. The loop closes back on you.
Nothing changes about how you practice. You still examine, reason, decide, and document. The difference is downstream.
Chat, documents, and the scribe run inside a single HIPAA-compliant workspace scoped to your practice, under a signed business associate agreement — not four vendors with four sets of terms.
We do improve our models from collective clinical data — that is how the tools get better, and pretending otherwise would be the same trick played politely. The difference is that contributing is a decision you make and can reverse, the pool improves DrCurbside tools and nothing else, and the people directing what gets built are the ones using it.
Retention windows you set, export of everything you've put in and everything we've produced, and deletion you can verify. Leaving costs you nothing but the subscription.
Full-strength AI on the differential, the packet, the note, the appeal — with a physician deciding what it's pointed at and what happens with the output.
A doctor with strong AI beats AI alone, and beats a doctor without it. Build that pairing inside a co-op and the capability keeps pointing back at the people who created it.
| Question to ask any vendor | Typical AI stack | DrCurbside |
|---|---|---|
| Can you use your own data with AI? | Rarely on your terms — your data works inside the vendor's product, in the ways the vendor decided. | Yes. Point full-strength AI at your own records, packets, and notes, and get the whole benefit of the technology out of them. |
| Who benefits when the tools get better? | The vendor and its investors. Your contribution is an input to someone else's asset. | A co-op improving tools for doctors, by doctors. You and your patients are the direct beneficiaries rather than the product. |
| Who decides what gets built next? | A roadmap set by the vendor, shaped by whoever is funding it. | The physicians using it. That is the whole reason for the structure. |
| Who agreed to the terms? | Often the health system or the vendor's enterprise buyer — not the clinician using it. | You do. The agreement is with your practice. |
| What happens to ambient audio? | Retention varies; audio is frequently kept as model-improvement material. | Stored in your environment. Used under your direction, or deleted on your schedule. |
| Can you take everything and leave? | Export is often partial and derived outputs may stay behind. | Full export of inputs and outputs, then verifiable deletion. |
| Who carries the liability for the output? | Increasingly ambiguous — that ambiguity is what the new licensure bills are for. | You do. This is early technology and every output needs a clinician's review — so the question is whether you'd rather review a tool you help direct, or one you don't. |
Read it yourself. Every claim on the left is drawn from public sources — vendor documentation, published model papers, and state and federal legislative text. They're all linked on Why it matters. Terms vary by product and by contract, so the honest advice is the same either way: read your BAA and your data use agreement before you type a patient into anything.
Read the fine print
A business associate agreement is supposed to be the document that protects you. Most of the ones in circulation were drafted to protect the vendor.
HIPAA governs protected health information. Strip the identifiers and the data stops being PHI — at which point HIPAA stops applying and the vendor may use it however it sees fit. A BAA that promises HIPAA compliance is promising the floor. It says nothing about what happens on the other side of de-identification.
Terms commonly allow data to be held indefinitely and used internally without further limit — for product development, analytics, quality, "service improvement," and whatever else that phrase is later read to cover. There is usually no number in the retention clause and no ceiling on the internal use.
Deletion language routinely covers the identified record while staying silent on what was captured and processed before it. If a de-identified derivative was created upstream, erasing the original does not reach it. Ask specifically what is generated from your data, when, and what deletion actually removes.
Many vendors require you to accept their terms before you can use the tool at all, and offer a stock BAA with no negotiation. You are agreeing to a document written by the party it protects. And when the tool is free, the arrangement is not charity — if you aren't paying for it, you're what's being sold.
Ours is written by clinicians, for clinicians. Our agreement says what your data is used for rather than listing what it isn't, states that contributing to the collective pool is your choice and reversible, and puts the direction of the product in the hands of the physicians using it. Read it against any other BAA on your desk — that comparison is the whole pitch.
Because the question isn't whether clinical data gets used to build AI. It already is. The question is who decides what gets built, and who it answers to afterward.
The direction of AI in medicine is currently being set by people who don't practice it. Built as a co-op, the clinicians using the tools are the ones deciding what gets built next — and that say is the point of the structure, not a feedback form.
Contributing to the collective pool is a decision you make, not a condition of using the product, and you can withdraw it. De-identification is not consent — so we ask instead of assuming.
Pooled data improves DrCurbside's tools and nothing else. That work is what lets a small group of doctors keep building for doctors instead of licensing the capability from whoever accumulated the most data.
Responses are monitored for safety, quality, and bias, because a tool clinicians are meant to trust has to be measured rather than asserted. Leading-edge is only worth having if it stays safe for patient care.
Not a cut-down clinical model. A secure frontier model inside a HIPAA-compliant environment scoped to your practice, so you can put real patient detail in and get a real answer back.
Access to a model is not the same as knowing where it belongs in a clinic day. We publish practical material on putting AI into a real workflow — what to hand it, what to keep, and how to check its work.
Use it for the practice you have, and the one you want. The immediate job is the administrative weight of a clinic day — the documentation, the packets, the payer correspondence. The longer one is giving a clinician the leverage to transform how they practice, or to build something that delivers care at scale. Both should be possible with tools you help direct.
Not yet — and the fight over that sentence is happening right now, in Congress, in state legislatures, and in regulatory sandboxes. A federal bill would let software count as a "practitioner" for prescribing. A model bill circulating in the states would license AI itself, up to fully autonomous diagnosis and treatment. Utah has already waived the rules for one company to run prescription renewals.
We think that's the wrong trade. Not because AI is useless in medicine — the opposite. AI is going to change the practice of medicine, and the only real question is who directs it: clinicians, or the handful of companies that accumulated the data.
We're onboarding practices now. Tell us what you'd point it at first.
Request early access