Bridge surfaces the chart a clinician already has open, in their own session, on their own device. Nothing has to be transmitted for an app to work out whether a patient is relevant, which removes most of the exposure before any control is applied to it.
Bridge reads the open chart and hands it to your app inside the browser, under the physician's own EHR sign-in. Your app decides what to show on the spot and updates as they move between charts, with nothing sent to make the call.
When the physician refers, enrolls or submits, your app sends that record directly to your servers. Bridge frames your app and signs the physician in, but the patient data never passes through us.
Bridge's backend handles sign-in, which app and settings to load, and health signals like errors and versions. It has no patient data store, and patient context is never routed through it.
Four properties of how Bridge runs, rather than four things bolted on afterwards.
Patient context is assembled when the clinician opens a chart, held in that tab’s memory while they are viewing it, and discarded when they navigate away.
Bridge does not write patient context to storage and does not transmit it to a Bridge server. Producing it requires no round trip through our backend.
The SDK passes the open chart to your app. Anything your app saves goes to your own backend, under your BAA with the clinic. Bridge doesn’t keep a copy.
Rules are fetched once and run locally, so for the patients who do not qualify — most of them — nothing has to be transmitted at all.
Your app holds the Business Associate Agreement with the clinic. Arrowhealth operates as a subprocessor to you and signs a BAA with you covering Bridge's role. We do not enter a direct relationship with the clinic. Where a clinic requires subprocessor disclosure, you can list Arrowhealth accordingly.
Our backend telemetry is operational health only: status codes, error types, integration failures and version information. It is designed to exclude patient data. Because it is generated from live clinical sessions we do not represent that incidental patient data can never appear in a telemetry event; the pipeline is built to avoid it, and anything incidental is covered under our BAA.
The full Bridge security overview, the SOC 2 report and a BAA are available to enterprise customers on request, under NDA.
