Security and data handling

No PII or PHI required at any stage

Mnomis is designed to operate on engagement and interaction patterns. We structure pilots to minimize sensitivity, reduce compliance burden, and support clear review by legal and clinical teams.

Back to homepage
Pilot reassurance
Minimum necessary data, purpose-limited use
Designed for review
Data types we do not need Names, addresses, SSN, DOB
Clinical content we do not need Diagnoses, notes, records
Typical pilot dataset Pseudonymized ID + events
Deletion On request or at pilot end

What we need for a pilot

We can start with modest history. The goal is to infer engagement structure and test intervention effectiveness with minimal exposure.

Minimum dataset

  • Pseudonymized member ID
  • Event type (outreach attempt, response, appointment, care gap)
  • Event timestamp
  • Channel (phone, SMS, email, mail) and outcome flags

Helpful, optional fields

  • Program or use case tag (for segmentation)
  • Language preference (if available)
  • High-level eligibility flags (non-clinical)
  • Aggregate utilization indicators (non-identifying)
If your organization prefers a limited dataset approach, we can align the export format to your policy. The system is designed to work without direct identifiers.

How we handle pilot data

These are the operational commitments that remove ambiguity during review.

Purpose-limited use

Data is used only to evaluate engagement patterns and intervention effectiveness for the pilot.

Access control

Access is restricted to authorized personnel supporting the pilot and can be reviewed on request.

Deletion and retention

Data can be deleted immediately on request or automatically at the conclusion of the pilot.

Secure transfer

We recommend secure transfer methods such as restricted-access drive shares or secure upload links. We avoid email attachments.

Minimum necessary principle

We request only what is necessary for inference and calibration. Engagement events provide sufficient signal.

If your team wants a short pilot data agreement, we can provide a simple 1 to 2 page document stating purpose, restrictions, access, and deletion terms.

Common reviewer questions

Do you ever require PII or PHI?+

No. The system is designed so pilots and ongoing operation can be conducted with pseudonymized IDs and behavioral interaction data only.

Is this subject to HIPAA?+

Your organization will determine policy scope. Our approach is to minimize data sensitivity by avoiding PII and PHI entirely whenever possible.

Can we run this behind our firewall?+

For pilots, most teams start with a restricted dataset export. For later stages, deployment options can be discussed based on your requirements.

What happens after the pilot?+

If you proceed, we align the operating model to your security and compliance posture. The same minimum-data principle applies.