Integral

Automated assessment and remediation drive the core module, and the deliverable a buyer buys is a signed human opinion. Software detects sensitive entities, measures re-identification risk and applies signal-preserving remediation across claims, record extracts, lab results and consumer data, and the Bleach API sanitizes training data automatically; the company reports 94.2 percent of analytical value retained and more than a trillion records processed.

But each HIPAA engagement ends in an Expert Determination signed by a qualified statistician, and the forward deployed service embeds people in the customer's pipeline, so the value is shared between the models and the experts.

Personal accountability runs through the published oversight, with one path outside it. For assessments, software measures re-identification risk and proposes remediation, and a qualified statistical expert validates the work and signs the Expert Determination or defensibility opinion, so a named person answers for each conclusion; the forward deployed program embeds statisticians and methodologists in the customer's pipeline. What the software decides alone is not stated, and the Bleach API, sold as automatically sanitizing data before it enters a training pipeline, describes no expert review at all.

The approach is named in terms a specialist can check, without calibration or versioning. The company describes a lifecycle of source, assess, engineer, deliver and re-assess; risk measured per dataset, use case and recipient; entity-preserving remediation that keeps longitudinal links, rare cohorts and behavioral signals; field-level retention tracking; and Expert Determination under the HIPAA statistical standard.

Earlier company material named privacy models including differential privacy and k-map analysis. No model version, validation of the risk estimates or assumptions about an adversary's outside data is published.

The chain is structurally short in three of four deployment models and unnamed in the fourth. In VPC, on premises, air-gapped and Databricks-native deployments the software runs in the customer's environment and no transfer to Integral or its providers occurs.

In managed cloud, the privacy policy says Integral uses service providers for hosting, analytics and payment under contract, but names none, publishes no subprocessor list, and does not say whether any model provider sees record text. Integral's detection and remediation models are presented as its own, while no outside party is enumerated for the managed cloud path.

Named customers and vendor reported figures, with no evidence on whether determinations hold. Quotes are attributed to named people at PurpleLab (timelines cut in half), Insagic (Publicis), OptimizeRx and Skyflow; the company reports 94.2 percent of analytical value preserved and more than a trillion records processed. No clinical evidence applies, since the product does not touch care. The evidence that would matter is adversarial: attempted re-identification of remediated datasets, ideally by an independent party, reporting how many records could be linked back. None is published.

Categorical commitments are published about the vendor's own handling of customer data, without a retention window. The privacy policy (March 2026) says healthcare data and other datasets uploaded or processed through the platform are processed solely to provide the services, used for no other purpose and never sold, and are retained according to the customer's service agreement; the terms confirm the customer keeps ownership.

Encryption in transit and at rest and access controls are described. No retention period is published for identified source data held before remediation, which is the period of highest exposure in the managed cloud option, and the training question is answered only by the "no other purpose" clause. Statistical deidentification with a signed Expert Determination is the product itself, separate from how the company handles the data it receives.

HIPAA status is stated with a business associate agreement offered, and the documents reach the service, with the agreement itself not published. The site footer states "HIPAA BAA Available"; the terms describe the service as a healthcare data compliance platform for privacy-regulated data including under HIPAA; and the privacy policy covers the platform, saying customer data is processed solely to provide the services under the customer's service agreement.

The customer's role is clear for healthcare data: a covered entity or business associate sending identified records to the managed cloud makes Integral a business associate or subcontractor; in self hosted models Integral may never hold the data. Its tier and subcontractor terms, like the agreement itself, are not visible before contracting.

Controls are asserted with nothing independent behind them. The privacy policy describes encryption in transit and at rest, access controls and regular security assessments, but no SOC 2, ISO 27001 or HITRUST attestation, penetration test cadence or trust center appears on the home, deployment, privacy or terms pages, and a search found none.

The gap matters most in managed cloud, where Integral holds fully identified health records before remediating them, on behalf of pharmaceutical, data broker and analytics customers. The company's own argument, that a secure building is not the same as defensible data, cuts the other way here: defensible output is produced inside an environment no one outside has examined. Buyers using a self-hosted model carry the environment's security themselves.

This is privacy engineering on datasets, with no clinical output, so no device claim is made and none applies. The company operates inside the HIPAA de-identification standard, producing Expert Determinations under 45 CFR 164.514(b)(1), and in non-HIPAA contexts a signed defensibility opinion. Answering to that standard is not a regulatory pathway.

The open issue is the standard itself: a determination has no set expiry but depends on what outside data exists, which argues for the continuous reassessment the company offers, and state health privacy laws increasingly reach deidentified categories with differing definitions.

Principles and process for the datasets, nothing on the models. The company describes independent risk assessment, expert sign-off and documentation built to be examined, but publishes no evaluation of its own detection and remediation models: how often identifiers are missed, by data type or source. The governance question specific to this product is uneven risk.

A determination concludes that re-identification risk across a dataset is very small, but people with rare diagnoses, unusual combinations of attributes or homes in sparse areas are far more identifiable than the average, and are often those whose records are most sensitive.

The output is documented and signed, and the published terms stand behind none of it. Each HIPAA engagement produces an Expert Determination signed by a qualified statistical expert, and the platform logs decisions with field-level retention tracking and continuous re-assessment, so a customer can examine how a dataset was treated.

The terms of service (March 2026) provide the services as is, disclaim that they are error-free, exclude indirect damages and have the customer indemnify Integral; nothing published says what Integral does if a determined dataset is re-identified or a determination is challenged in an audit. The people affected by a failed de-identification are the patients in the dataset, who have no relationship with the vendor.

No record system integration applies: the product takes datasets a customer already holds, such as claims and record extracts, and returns remediated copies. The integration surface is the data pipeline. The company names a Databricks native deployment and offers the Bleach API for sanitizing data before training, but describes no ingestion or delivery formats, connectors or token lifecycle in technical terms. Linkage tokens that persist across datasets and over time are what make longitudinal analysis possible, and also what let separately remediated datasets be joined.

Four deployment models are documented, with residency stated for three. The deployment page offers managed cloud (Integral operates the platform and processes data in its own environment), VPC or private cloud in the customer's account, on premises, and fully air-gapped deployment, plus a Databricks-native option, with the same methodology across all and migration between them supported. For the three self-hosted models the data stays in the customer's environment.

Managed cloud, described as the fastest route and the usual starting point, names no provider, region or isolation model, so the option most customers begin with leaves where identified data rests unstated.

The sales model is discoverable even though no price is published: forward deployed privacy programs embedded in a customer's pipeline, enterprise data sanitization with a signed opinion, and the Bleach API, all reached through a demo. Engagements are scoped per dataset and determination, and the forward deployed service includes embedded statisticians and engineers, so the unit may be the engagement, the dataset or ongoing program time. Which unit applies is not stated, nor whether continuous reassessment is priced separately or whether the Bleach API has self serve pricing.

Coverage is read as data types and buyers, since the product is not used in care. The company now presents itself as an independent privacy layer for AI: its buyers are AI builders (frontier labs, enterprise AI applications, data labelers) and data holders (pharma and life sciences, data brokers and marketplaces, analytics and marketing), and it processes healthcare and clinical records alongside behavioral, consumer and enterprise data; its terms still describe a healthcare data compliance platform, and HIPAA Expert Determination remains its signature output.

It also markets data monetization and the merging of clinical with consumer data, which creates the combinations that raise the hardest privacy questions. The patients in these datasets are not the customer.