BAA with your practice
Signed with you, not with an enterprise buyer who negotiated terms you never saw. You are the covered entity; we are the business associate.
Product
Three tools, and a say in the fourth.
A secure LLM chat you can put PHI into, documents it can read and write, and an ambient scribe — all inside one HIPAA-compliant workspace that belongs to your practice, built by a co-op whose direction its members set.
Chat
Secure, HIPAA-compliant LLM chat
The curbside consult, available at 2 a.m. and safe to be specific with.
- Ask with real patient detail — under a signed BAA, not a disclaimer telling you to de-identify first
- Differentials, workup sequencing, dosing and interaction questions, guideline reasoning
- Draft patient instructions, letters of medical necessity, and specialist referrals
- Conversations persist across a case, so you're not re-explaining the patient every time
- Answers you can interrogate — ask it what would change your mind
Documents
Document read and write
The 40-page packet is the job. This is the part that gives you the evening back.
- Upload consult packets, discharge summaries, outside records, labs, imaging reports, PDFs of trials
- Ask across the whole set: what changed, what's missing, what contradicts what
- Write back out — appeal letters citing the denial's own language, referral summaries, prior-auth narratives
- Answers point at the passage they came from, so verification takes seconds
- Your templates and phrasing, not a generic house style
Scribe
AI scribe
Ambient documentation that produces a note you'd actually sign.
- Ambient capture of the visit, structured into your note format
- Draft orders, follow-up, and patient-facing summary alongside the note
- You edit and sign — nothing enters the record on its own
- Recordings and transcripts stay in your environment, used under your direction
- Audio retention is a setting you control, and deletion is verifiable
Your data
What actually happens to it
Stated as what it's used for, rather than a list of things we promise not to do.
- Your content lives in an environment scoped to your practice, under your BAA
- Contributing to the collective pool is opt-in, and you can withdraw it
- Pooled data improves DrCurbside's tools — that is the scope, and it's in the agreement
- Safety, quality, and bias monitoring runs against what those tools produce
- Full export and verifiable deletion, on request, at any time
Security posture
The specifics your compliance officer will ask for, stated plainly.
Encrypted end to end
TLS in transit, strong encryption at rest, US-based infrastructure, and key management documented in the agreement rather than in a blog post.
Access control and audit
Per-user accounts, role-based access, and an audit log of who saw what and when — exportable, because you may need to produce it.
Retention you set
Chat history, uploads, transcripts, and audio each have a retention window you configure. Default is the shortest setting that keeps the product useful.
Exit without hostages
Export everything you put in and everything we produced, in open formats, then delete. If you had opted in, withdrawing stops any further use — and we'll tell you plainly what that does and doesn't undo, rather than implying it unwinds a model already trained.
In writing, not in marketing
Every commitment on this page belongs in your contract — the opt-in, what revoking it does, and the scope pooled data may be used for. If a vendor won't name that scope in the agreement — us included — that's your answer.
What it is not
DrCurbside does not diagnose, does not prescribe, and does not act on a patient without you. There is no autonomous mode on the roadmap and no plan to seek one under an AI practitioner license, because the thing that makes this safe is that a licensed clinician is deciding.
It is also not an EHR and not a replacement for one. It sits beside your record system and makes the work around it faster.
Every output is a draft for a clinician to review. Clinical responsibility stays with you — which is exactly the arrangement we're arguing to preserve.
Evaluating us, or anyone else? Ask for four things in writing: a signed BAA, a named scope for what your data may be used for and whether that use is opt-in, a retention and deletion policy with the numbers filled in, and a full-export commitment. Any vendor that won't put a boundary on the second one is telling you what its business model is.
Early access. We're onboarding a small number of practices and working directly with them on note formats, document workflows, and the details that decide whether a tool survives a clinic day. Get in touch.