Government requests. Breaches. Uptime. AI overrides.

What we received. What we served.

Every legal process served on Conceptual Health is logged, reviewed by counsel, and counted here. We push back on overbroad requests, narrow them where possible, and challenge those without proper process. We never volunteer PHI and we always notify the affected patient unless legally barred from doing so.

What this section will look like in Phase 2: a per-request-type table — civil subpoena, criminal subpoena, search warrant, NSL, foreign court order, civil investigative demand, FTC / state AG request — with per-request notes on narrowing, challenge, and patient notification. Today the table is empty.

Every notifiable breach. Closed or open.

HIPAA Breach Notification Rule defines a breach as the acquisition, access, use, or disclosure of PHI in a manner not permitted under the Privacy Rule that compromises its security or privacy. We disclose every notifiable breach here on the same business day we report it to OCR. We also disclose non-notifiable security incidents (lost devices, suspicious access patterns) for transparency, even when no PHI was exposed.

What we will publish for each event: detection timestamp, OCR disclosure timestamp, scope (PHI fields exposed), affected individuals, root cause, remediation, postmortem link, lessons-learned governance event. We will never anonymize a breach event by omitting it. If a breach happens, you will read about it here before you read about it anywhere else.

Patient-facing uptime. Measured, not promised.

We do not publish a 99.9% uptime claim today, because we have not yet operated long enough at production load to back one. Once Phase 2 begins and the first 90 days of measured production traffic are in the books, this section will show a per-component daily heatmap and a rolling 30 / 90 / 365-day percentage straight from /api/v1/site/facts.

Status page (live, reads from the same source): status.conceptualhealth.com. Once Phase 2 begins, this section embeds the rolling heatmap and the SLA target per component.

Where the model was wrong. And what we did about it.

Every clinical AI suggestion that is overridden by a clinician, every patient-facing AI response flagged by the user as wrong, and every content-moderation action that is appealed and reversed — those are the events that teach us what the model gets wrong. We count them, publish the count, and for the highest-severity ones publish the lesson learned.

Phase 1 framing: the in-house clinical AI (GuardianOrb medical brain, BGE-large embeddings, Qwen2.5-7B inference) is in pre-launch validation with a physician-reviewer queue and an HMAC-chained audit trail. Every suggestion already gets reviewed before it reaches a patient surface. When Phase 2 begins, the rate of override and reversal becomes a public number, on this page, every quarter.

Cadence, signing, archive.

• Quarterly cadence. A snapshot of the /api/v1/site/facts transparency block is signed and posted within 30 days of quarter-end.
• Signed snapshot. Each quarterly snapshot is hashed (SHA-256), signed by the Privacy Officer's Ed25519 key, and anchored to chain.conceptualhealth.com as a transparency-event entry.
• Archive. All prior quarters remain on this page, oldest at the bottom, with their signed hash and chain anchor visible.
• No re-write. Once a quarter is published and signed, the numbers do not change. A correction (clerical, scoping, late-arriving event) is appended as a new entry with its own hash and a link back to the original.
• Phase 1 today. Until Phase 2 begins, every section above shows zero. We would rather show zero than estimate.