Can I send health records or other sensitive data through ModelRiver?
Updated
Please don't send health data or other special categories of personal data unless it's truly necessary and lawful. ModelRiver doesn't currently offer HIPAA compliance or a Business Associate Agreement (BAA), so it isn't suitable for protected health information.
What counts as sensitive data?#
Data that needs special care under privacy laws, for example:
- Health or medical information
- Racial or ethnic origin, religion, political opinions
- Genetic or biometric data
- Sex life or sexual orientation
- Government ID numbers and payment card numbers
My prompts include ordinary personal data, like names and emails. Is that okay?#
Yes, that's covered by our Data Processing Agreement. Still, send only what the model actually needs to do its job.
How can I reduce what's stored?#
- Strip or mask data first. Remove names, emails and IDs before sending, if the task doesn't need them. ModelRiver doesn't redact data automatically.
- Turn off full text logging for the project, so new request logs keep details like model and tokens but not the prompt or response. See What data does ModelRiver store?
- Keep guardrails on. Prompts blocked by guardrails are never stored.
- Check your provider's terms. Your data also goes to the AI provider you choose, under your own agreement with them.
Do you plan to support HIPAA?#
Not today. If it's important for your use case, tell us at team@modelriver.com.