SECURITY & COMPLIANCE
OUR APPROACH
Clinical AI safety, built on three pillars
Regulatory compliance
Our ISO 13485-certified quality management system and ISO 27001-certified information security management system support the development and operation of safe, secure clinical AI. HIPAA compliance and SOC 2 provide additional assurance over how patient data is protected.
Specialised agents within an approved scope
Specialised agents handle defined tasks within an approved scope. Deterministic rules govern the permitted actions and escalation, while conversational models support natural interactions.
Ongoing evaluation and human oversight
Scenario testing evaluates behaviour before launch. Once live, AI monitoring helps identify conversation-quality patterns, while AI Sentinel and human-in-the-loop review support the quality checks configured for each programme.
SECURITY & COMPLIANCE
Built to protect patient data
Tucuvi Health Manager, including LOLA, is designed for the security reviews health systems run before go-live.
HIPAA. PHI handled under a Business Associate Agreement, with data minimization.
SOC 2 Type II. Our security controls are independently audited over time, with the report available to your security team on request.
Encryption and access. PHI encrypted in transit and at rest, role-based access controls and single sign-on with your identity provider.
Audit and monitoring. A full audit trail links every output to its source, with prompt injection protection and continuous monitoring.
AI governance. Accountability under BS 30440 and alignment with the EU AI Act.
Medical device certification. CE-marked as a Class IIb Software as a Medical Device (SaMD) under the EU Medical Device Regulation. An independent notified body audits the product’s clinical evaluation, risk management and quality system (ISO 13485, IEC 62304), before and after launch.
REGULATORY COMPLIANCE
Safe, clinically validated AI
Tucuvi Health Manager, including LOLA, is designed for the security reviews health systems run before go-live.
HIPAA. PHI handled under a Business Associate Agreement, with data minimization.
SOC 2. Our security controls are independently audited, with the report available to your security team on request.
Encryption and access. PHI encrypted in transit and at rest, role-based access controls and single sign-on with your identity provider.
Audit and monitoring. A full audit trail links every output to its source, with prompt injection protection and continuous monitoring.
AI governance. Accountability under BS 30440 and alignment with the EU AI Act.
Medical device certification. CE-marked as a Class IIb Software as a Medical Device (SaMD) under the EU Medical Device Regulation. An independent notified body audits the product’s clinical evaluation, risk management and quality system (ISO 13485, IEC 62304), before and after launch.
.png)
https://vimeo.com/1239411543/5f699643b2?share=copy&fl=sv&fe=ci
MULTI-AGENT APPROACH
Specialised agents, working within a defined scope
LOLA, the AI agent within Tucuvi Health Manager, coordinates a network of purpose-built AI agents, from appointment scheduling to post-discharge care.
Each agent uses the model and tools best suited to its task, and together they support patients across the care journey.
All of them work within a defined workflow and under human oversight.
https://vimeo.com/1239411543/5f699643b2?share=copy&fl=sv&fe=ci
MULTI-AGENT APPROACH
Specialized agents, working within a defined scope
LOLA, the AI agent within Tucuvi Health Manager, coordinates a network of purpose-built AI agents, from appointment scheduling to post-discharge care.
Each agent uses the model and tools best suited to its task, and together they support patients across the care journey.
All of them work within a defined workflow and under human oversight.
QUALITY PROCESS
Safety first, with control at every stage
Our process combines automated testing, structured feedback, controlled rollout and ongoing evaluation. Each programme defines the checks and review arrangements relevant to its scope.
Scenario-based testing
Before launch, automated scenarios test expected conversations and difficult situations. Checks cover the actions LOLA takes, the information it records, escalation behaviour and the quality of its responses. Issues lead to fixes and repeat tests.
Empathy and user experience validation
Clinicians and experts in conversation design and quality role-play different patient profiles to refine each agent’s tone, pacing and accessibility.
Controlled rollout
The first live interactions are manually audited for performance and empathy before rollout expands.
Human-in-the-loop review
AI Sentinel checks completed interactions against the programme’s configured quality criteria. Cases requiring human judgement go to Tucuvi’s review team before results are released.
Scenario-based testing
Before launch, automated scenarios test expected conversations and difficult situations. Checks cover the actions LOLA takes, the information it records, escalation behavior and the quality of its responses. Issues lead to fixes and repeat tests.
Empathy and user experience validation
Clinicians and experts in conversation design and quality role-play different patient profiles to refine each agent’s tone, pacing and accessibility.
Controlled rollout
The first live interactions are manually audited for performance and empathy before rollout expands.
Human-in-the-loop review
AI Sentinel checks completed interactions against the program’s configured quality criteria. Cases requiring human judgment go to Tucuvi’s review team before results are released.
SAFETY BY DESIGN
AI in the loop, not in control
In Tucuvi Health Manager (THM), safety-critical decisions follow deterministic logic defined in each clinical workflow, not AIinference. LOLA, the AI agent within THM, works inside theworkflow your team approves, and escalation criteria are set byyour clinicians.
THM is developed under an ISO 13485-certified quality management system, with risk management, clinical evaluation anda software lifecycle aligned with IEC 62304.
https://vimeo.com/1239414558/158f49c28c?share=copy&fl=sv&fe=ci
BELOW THE WATERLINE
What clinically safe AI agents are made of
Designing the conversation and connecting it to patient data is only the visible part. Below it sit six layers of work that support the safety of every interaction within Tucuvi.
https://vimeo.com/1239283194/94e55c73a4?fl=tl&fe=ec&share=copy
https://vimeo.com/1239283194/94e55c73a4?fl=tl&fe=ec&share=copy
