A censored chart is a wrong diagnosis, waiting.
HIPAA binds your practice, and it stops at your door. Once a patient's words sit on a consumer chatbot's servers or in a data broker's file, they are outside it — and investigators never needed a warrant for what they could simply buy.
Your patient knows this. So they edit. They leave out the part they are actually frightened of, and you write your note on the version they were willing to say out loud.
Everything below exists so they don't have to.
Here is exactly how it is built. Hold us to every line.
Most vendors hand you a badge and ask you to stop asking questions. We're opening the hood. Every claim below describes how ElderberryAI works today.
1. The AI is ours. It's called Sage, and it never phones home.
Sage is our own AI, self-hosted inside our HIPAA-covered environment. We built it, we run it, and it does not leave the building. When your patient describes their symptoms, that text is processed on infrastructure we own. It is never sent to OpenAI, Anthropic, Google, or any other frontier lab for inference.
A vendor whose AI is a wrapper around somebody else's API cannot make this claim — their inference call is a copy of your patient's words, leaving their control, on a server they do not own. There is no third party in the room to subpoena, because we didn't put one there.
2. Identity is separated from clinical content.
Who someone is, and what is wrong with them, are stored apart. The work that doesn't need a name runs against de-identified data. A single compromised store does not yield an identified patient record. That is the design constraint, and it drives everything else.
3. Encrypted at rest and in transit. Keys managed, never hardcoded.
Encryption on every byte, moving and sitting still. Keys are held in a managed key service and rotated. There is no standing master key to everything — not for a vendor, not for an engineer, not for us.
4. Least privilege, enforced per tenant.
Your practice's data is scoped to your practice. Access is granted by role, to the minimum necessary, and it is denied by default. There is no internal "look at everything" account.
5. Every access to patient information writes an audit-log entry.
Who touched what, and when — recorded on every read, not just every change. If you ever need to know who has looked at your patient's chart, the answer exists and it is retrievable.
6. No PHI to advertisers. No third-party ad pixels. Anywhere.
First-party analytics only. There is no Meta pixel, no ad-network tag, no data-broker feed. The GoodRx and BetterHelp FTC cases happened because the data was piped somewhere it could be monetized. Here, it never leaves the environment it lives in — so there is nothing in the pipe.
7. Nobody can pay to tilt the answer.
An AI never has to lie to change medicine. It only has to tilt — which treatment surfaces first, which drug makes the summary and which quietly doesn't. No pharma company, no payer, no advertiser, no agency can buy influence over what ElderberryAI surfaces for you. We do not sell that. There is no price.
Where the line is.
Straight answers to the two questions every careful physician asks next.
We can be served with a lawful subpoena. Anyone can. What we control is how little there is to hand over, and how few parties hold it. No frontier lab has your patient's words. No data broker has them. No advertiser has ever seen them.
We facilitate. We do not diagnose. ElderberryAI surfaces evidence, organizes records, and drafts the coordination. Every clinical decision is yours, and it stays yours. Emergencies route to 911, always.
Ask any other AI vendor one question: where does the inference call go? Then compare their answer to ours.
The Elderberry Pledge — promises with teeth.
A privacy policy describes what a company may do with your patient's data. The Elderberry Pledge sets out what we have permanently bound ourselves never to do.
It is written into our Terms of Service. That makes it a contractual commitment to every practice and every patient on this platform, enforceable like any other term you sign. We put it in the contract because a promise that costs nothing to break is worth nothing.
- We will never sell patient data. Not to a data broker, not to a pharmaceutical company, not to a payer, not to anyone, at any price, ever.
- We will never send patient information to an advertiser, and we will never place a third-party ad pixel or tracker anywhere a patient can reach.
- We will never send your patient's words to a frontier lab for inference. Sage is ours and it stays inside our environment.
- We will never take money to change what the AI tells you. No pharma company, payer, advertiser, or agency can buy placement, ranking, or emphasis in a clinical answer.
- We will never gate a clinical AI feature behind a paid tier. Every AI capability is in the free plan.
- We will never voluntarily hand patient information to a government agency. We require lawful process, we resist overbroad demands, and we notify the affected practice wherever the law permits.
- If we ever break one of these, we will say so publicly. Named, dated, and on this page.
If a vendor won't put their version of this in writing, that is your answer.
What you actually get.
Every AI feature is in the free tier. All of it. A paid plan adds human staff — our Care Team doing the work for you — and lifts the active-patient cap. It does not unlock a single AI capability, because none of them are locked.
AI Scribe
Ambient documentation that drafts your note during the visit.
AskEvidence
Evidence-grounded answers with real citations.
Records & Inbox
Records chased, organized, and routed.
Specialist coordination
Referrals booked and the loop closed.
Medication reconciliation
Across every provider your patient sees.
Practice analytics
A real dashboard.
FHIR-native. No rip-and-replace. No new headcount.
The free plan covers 20 active patients. Practice ($49/provider/mo) makes it unlimited and brings in our human MA team — full inbox management, appointment coordination, insurance navigation and appeals. Your patients are free at every tier, with no cap, forever.
What your staff has to do: nothing new.
Sign up takes minutes. There is no implementation project, no six-week go-live, and no line item. Invite one patient and see it work before you tell anyone else on staff. You have 20 to spend before you decide anything.
Who we are.
Elderberry was founded as a public service, by one of the early pioneers of the public benefit corporation.
It grew out of our founder's own diagnosis — a rare cancer with a 72-month average time to diagnosis, caught at Stage 1 in six months because his care was finally coordinated. Extended to other patients, the same approach cut time-to-diagnosis by roughly 70%.
We are building the thing that would have found it sooner, and putting it in the hands of every independent practice and every patient. That is the whole company.
FAQ
What AI do you run?
Sage — our own AI, self-hosted inside our HIPAA-covered environment. No patient inference call ever leaves for a frontier lab. Ask any other AI vendor the same question and see whether they can name their model, or only their supplier's.
Does it work with my EHR?
FHIR-native architecture. We integrate with EHRs supporting FHIR R4; specific integrations roll out by practice.
What does it cost?
$0 to start, with every AI feature included and up to 20 active patients. Practice is $49 per provider per month: unlimited active patients plus our human MA team. Your patients are always free, with no cap, at every tier.
How do you make money if the AI is free?
Practices pay for people, not for AI — our human Care Team, and unlimited patients. Advertising never touches patient data: no PHI to advertisers, no third-party ad pixels, ever.
What if I want out?
Export your data and go. No contract.
Learn more
Trust & data rights
Our complete privacy and trust practices — no advertising, HIPAA compliance, and your data rights in plain language.
Read more →No patient ads
We do not target patients with health-condition ads based on what they share. Exactly what this means and how we enforce it.
Read more →HIPAA notice
Your rights under HIPAA and how ElderberryMD handles protected health information.
Read more →