The architecture is the control. Where a claim depends on configuration rather than construction, this page says so.
Records are written to the per-user application directory on the device. No product opens a network listener in its request path.
Model execution is local. Prompts and documents are not transmitted to a third-party inference provider.
Licences are Ed25519-signed and machine-bound; store purchases are verified against Apple's and Google's own signatures on the device.
Sensitive operations append to a SHA-256 hash-chained ledger that can be verified independently of the application.
Where a passphrase is configured, stores are sealed with XChaCha20-Poly1305 under an Argon2id-derived key.
Application windows run under a Content Security Policy that forbids inline and dynamically evaluated script.
Keeping protected health information on the practitioner's own device removes an entire class of disclosure risk, and it is the reason the clinical products are built this way. It is not, by itself, a compliance certification: HIPAA obligations attach to the covered entity and its agreements, and no software product discharges them on your behalf. We document what the software does so that assessment is straightforward.