Plain-language summary of the data architecture. A complete FIPS 199 compliance plan accompanies the KidneyX submission and is available on request.
Your name, email, and contact information live in an identity database. Your health intake (BMI, blood pressure, smoking status, lifestyle context) lives in a separate de-identified database, keyed by a random donor identifier. The two are linked only through a server-side join that requires authentication and is audit-logged.
Renara uses large language models for plan personalization and the Donor Companion. The payload sent to the model is constructed from a fixed schema - only the fields on the allowlist may be included. Identity fields are structurally impossible to send.
Free-text fields (lifestyle context, Donor Companion questions) pass through a scrubbing middleware that removes names, email addresses, phone numbers, dates of birth, and street addresses before the text reaches the model.
For each call to the language model we record a timestamp, the donor identifier, hashes of the payload and response, the model version, and the originating route. Logs are retained for compliance review and are accessible to the donor on request.
Renara uses a third-party model vendor (Anthropic) for inference. Today only allowlisted, PII-scrubbed, de-identified inputs are sent, and the current beta runs on synthetic and demo data - not real patient records. Before Renara processes any real protected health information in production, a HIPAA Business Associate Agreement and a zero-data-retention configuration will be executed with the vendor. Self-hosted inference on HIPAA-eligible infrastructure remains on the roadmap.
Renara is built to WCAG 2.0 Levels A and AA from the first commit. Security categorization follows FIPS 199 with PHI assessed as Moderate confidentiality, Moderate integrity, and Low-to-Moderate availability - mapped to the NIST 800-53 Moderate control baseline.