Healthcare
APIs and AI on sensitive data, without letting it out.
Flexway helps you meet the confidentiality and traceability requirements of health data: sensitive requests pinned to your internal models, no personal data in logs, every access traced.
What Flexway decides, on your infrastructure
Who calls, what Flexway decides, what is called: each route is a use case of your sector. Dashed: what is coming.
Architecture for healthcare: care apps, partner facilities and the AI assistant go through Flexway, on your infrastructure. Flexway applies the contract's scopes and roles, identifies partners by client certificate, audits without content, routes each model request by policy and pins a sensitive request to the internal model, in front of the patient record and the internal model. A sensitive request is served by the internal model; without an internal backend it gets a 403, never an external model.
- Care apps
- The care applications: their calls to the patient record go through Flexway, under the contract's scopes and roles.
- Partner facilities
- The partner facilities: identified by client certificate, their proven tenant is passed on to your services.
- AI assistant
- An AI assistant: it calls the models through Flexway's OpenAI-compatible surface, under budget and policy routing.
- Scopes and roles from contract
- The required scopes and roles come from the contract; a caller out of scope gets 403.
- Client certificate
- The client certificate (mTLS) identifies each partner and binds it to its tenant, passed on proven to your services.
- Sensitive request pinned
- A request marked sensitive goes only to an internal model, never to an external provider.
- Policy-based routing
- Flexway picks the model by policy: default backend, declared override or soft cap depending on the request.
- Audit without content
- Every authorization decision is logged in a chained, verifiable audit, without request content.
- Patient record
- The patient record: only callers with the right scopes and roles reach it, with no content logged.
- Internal model
- A model running on your premises: sensitive requests never leave your infrastructure.
- External model
- A model provider outside your infrastructure: called under budget, never for a sensitive request.
- Line: one route
- Interchange: shared decision
- Request
- Model or tool call
- Refusal
- Your infrastructure
- Scopes and roles from contracttokens from several issuers
- Client certificateupstream gets the proven tenant
- Sensitive request pinnedalways to an internal model
- Policy-based routingmodel chosen per request
- Audit without contentprompt never logged
1A clinician opens a record
What Flexway decidesThe token is checked, scopes and roles read from the contract; what is not declared is refused.
What is protectedEvery access can be found in the chained audit.
2The AI assistant summarises a consultation
What Flexway decidesThe request marked sensitive is pinned to the internal model, never sent to an external model.
What is protectedHealth data stays on your infrastructure; the prompt is never logged.
3A partner facility queries your services
What Flexway decidesIts client certificate identifies it and carries its tenant; the upstream receives that tenant, never a credential of the caller.
What is protectedOnly declared facilities reach the patient record.
Care apps
The care applications: their calls to the patient record go through Flexway, under the contract's scopes and roles.
Routes through here
Partner facilities
The partner facilities: identified by client certificate, their proven tenant is passed on to your services.
Routes through here
AI assistant
An AI assistant: it calls the models through Flexway's OpenAI-compatible surface, under budget and policy routing.
Routes through here
Scopes and roles from contract
The required scopes and roles come from the contract; a caller out of scope gets 403.
- Decision
- tokens from several issuers
- Catalogue features
- Scopes and roles derived from the contract's security ; iss and aud checked; several issuers in one configuration
Routes through here
Client certificate
The client certificate (mTLS) identifies each partner and binds it to its tenant, passed on proven to your services.
- Decision
- upstream gets the proven tenant
- Catalogue features
- API keys and client mTLS as first-class identities
Routes through here
Sensitive request pinned
A request marked sensitive goes only to an internal model, never to an external provider.
- Decision
- always to an internal model
- Catalogue features
- Sensitive requests pinned, sovereignty and fallback by policy
Routes through here
Policy-based routing
Flexway picks the model by policy: default backend, declared override or soft cap depending on the request.
- Decision
- model chosen per request
- Catalogue features
- Policy routing across providers and models
Routes through here
Audit without content
Every authorization decision is logged in a chained, verifiable audit, without request content.
- Decision
- prompt never logged
- Catalogue features
- Chained audit log of authorisation decisions ; Metadata audit, never a prompt ; Structured JSON logs, no personal data
Patient record
The patient record: only callers with the right scopes and roles reach it, with no content logged.
Routes through here
Internal model
A model running on your premises: sensitive requests never leave your infrastructure.
Routes through here
External model
A model provider outside your infrastructure: called under budget, never for a sensitive request.
- Catalogue features
- Policy routing across providers and models
Routes through here
What the sector requires
- GDPR · health data hostingNo sensitive data at a provider
- A request marked sensitive is never sent to an external model; prompts are never logged, identifiers are hashed.
- Access controlStrictly declared access
- Tokens from several issuers, scopes and roles read from the contract; what is not declared is refused.
- TraceabilityEvery access traceable
- Chained audit of authorisation decisions and end-to-end traces, with no request content.
- InteroperabilityAuthenticated partners
- Client certificates for partner institutions and vendors, bound to a tenant and to operations; the upstream receives the certificate's tenant, never a credential of the caller.
What the sector expects
The expectations of your sector found in the market analysis, and where Flexway stands on each; what another component does better is stated.
| What enterprises expect | Flexway v1.6.3 |
|---|---|
| Conformance of FHIR resources to their profilesValidation against the contract's JSON schema only; FHIR profiles: candidate | To be scheduled |
Connect legacy systems (HL7 v2, CDA)The role of an integration engine; SOAP and XML on the horizon (2.0.0 for the decoders) | Left to another component |
Consent, access traceabilityAccess audit built; consent decided by the customer's service, reachable through external-call | Partly · next to be scheduled |
Out-of-range device dataSchema minimum and maximum bounds on validated payloads; clinical rules stay with the service | Partly · next to be scheduled |
| Health AI: models approved per data type, tracesData classes, allowed backends, decision line | Planned in 1.9 |
| Coordination of care pathwaysA business orchestration, not a gateway | Left to another component |
| Distributed clinical gatewayMQTT proxy planned, edge mode planned | Partly · next in 1.7 |
| Cross-organisation collaboration, federated learningAnonymisation and federated learning need dedicated mechanisms (the analysis says so) | Left to another component |
Upcoming releases are not commitments; "Delivered" only when the catalogue of the published release says so.
How Flexway answers
No sensitive data at a provider
- Sensitive requests pinned, sovereignty and fallback by policyDelivered · v0.1.0
- Metadata audit, never a promptDelivered · v0.1.0
- Structured JSON logs, no personal dataDelivered · v0.1.0
Strictly declared access
- iss and aud checked; several issuers in one configurationDelivered · v0.1.0
- Scopes and roles derived from the contract's securityDelivered · v0.1.0
- Closed by default: undeclared header, parameter, method or origin refusedDelivered · v0.1.0
Every access traceable
- Chained audit log of authorisation decisionsDelivered · v0.1.0
- W3C traces propagated end to endDelivered · v0.1.0
Authenticated partners
- API keys and client mTLS as first-class identitiesDelivered · v0.1.0
- RFC 8693 token exchange: human subject, agent actorDelivered · v0.1.0
State in Flexway's latest published release; a feature is marked delivered only with its release.
What Flexway does not do
- Flexway alone does not make an organisation meet its obligations: it provides controls and traces your compliance setup uses.
- No health data hosting certification is claimed by the software: it belongs to the host you run it on.
Let's talk about your gateway
Flexwiz is a young company: you talk directly with the person who founds it. Tell us what you want to run through Flexway. We talk about your infrastructure and your digital sovereignty requirements.
Online booking is coming soon; until then, an e-mail is enough.