BioinvestGPT ApS · Research use only
Security and HIPAA-compliant architecture
BVCT runs on a HIPAA-compliant architecture: sensitive fields such as drug designs and contact details are encrypted with AES-256-GCM, passwords are hashed with Argon2id, access tokens are short-lived, and backend data operations are written to a hash-chained audit log. BVCT is patient-data-free by design, so running a virtual trial does not require patient records.
Last updated · Maintained by BioinvestGPT ApS
What does "HIPAA-compliant architecture" mean here?
It means BVCT's safeguards are designed around the technical safeguard standards of the HIPAA Security Rule (45 CFR §164.312): access control, audit controls, integrity, person or entity authentication, and transmission security. It is not a certification. HIPAA has no official certification, and whether a particular organization's use of BVCT meets HIPAA also depends on that organization's own policies and agreements.
Which safeguards does BVCT implement?
| Standard | How BVCT implements it |
|---|---|
| Access control, §164.312(a) | Individual accounts with unique user IDs; role, permission-scope or record-ownership checks on authenticated data routes; re-authentication with the password after a page reload. |
| Encryption at rest, §164.312(a)(2)(iv) | Sensitive fields in the database, including drug designs, investigator and contact details, MFA secrets and one-time-code hashes, are encrypted with AES-256-GCM at field level. Account email addresses and names are also stored unencrypted, so that accounts can be found at sign-in. The signed-in session kept in the browser is encrypted with AES-256-GCM through the Web Crypto API, using a non-extractable key derived from the user's password. |
| Audit controls, §164.312(b) | Sign-in events and backend data operations are written to an audit log that the application only appends to. Since April 2026 each entry is hash-chained to the previous one, so altering or deleting an entry breaks the chain and is detected by an offline verifier. |
| Integrity, §164.312(c) | AES-256-GCM is authenticated encryption: modified ciphertext fails to decrypt. The hash chain makes changes to audit entries written since April 2026 detectable. |
| Person or entity authentication, §164.312(d) | Passwords are hashed with Argon2id. Access tokens are signed and expire after 15 minutes, with separate refresh tokens. Sign-in endpoints are rate-limited. |
| Transmission security, §164.312(e) | All traffic uses HTTPS, with HTTP Strict Transport Security; plain-HTTP requests are redirected to HTTPS. |
Does BVCT need patient data?
No. BVCT is patient-data-free: a virtual trial is specified at population and trial level (drug, disease, comparator, endpoint and eligibility criteria), so running one does not require patient records. In the research-question workflow, questions that contain individual-patient detail are blocked in the browser, and the server rejects them again (HTTP 422) when the question is saved.
BVCT uses third-party large-language-model services (Google Gemini, Anthropic Claude and OpenAI) to compute parts of each virtual trial, so the trial inputs you enter are sent to these providers. Do not enter protected health information; BVCT does not need it.
Some optional design workflows can also call third-party computation services. Submissions to a public service that is not covered by a Business Associate Agreement (BAA) are blocked unless the user confirms, for that run, that the input contains no protected health information; the confirmation is recorded in the audit log.
What does this page not claim?
This page describes technical safeguards in the platform's code and hosting. It is not a legal opinion, an audit report or a certification, and it does not describe the contractual terms, such as a Business Associate Agreement, that apply to any customer. For security documentation, contact BioinvestGPT ApS.