Solutions — sector
We make no HIPAA or FDA claim.
An earlier version of this website said Rotascale maintained HIPAA and FDA compliance. Neither was true. This page exists partly to correct that in the open, because a governance vendor that quietly deletes a false claim has told you something about how it handles the next one.
What is actually true
- No HIPAA claim
- We hold no HIPAA attestation and sign no BAA. RotaGrant runs in your environment and receives no payload, which is a different and in some ways stronger position — but it is not a HIPAA claim and we will not dress it as one.
- No FDA claim
- RotaGrant is not a medical device, is not cleared as one, and is not a component of anyone's cleared device. If your system is regulated as SaMD, that regulatory burden is yours and this software does not reduce it.
- Health data is special category
- GDPR Art. 9 applies, and the platform's position is that special category attributes are declared and never inferred. It does not detect clinical free text — names, addresses and diagnoses carry no checksum and are not looked for.
Where it does contribute
An administrative agent that schedules, triages correspondence, or moves money is governable in exactly the way any other agent is: bounded authority, refusals with causes, oversight records, and an incident clock where the AI Act's Annex III classification applies. Deployment is single-tenant in your environment, up to and including airgapped.
A clinical decision-support system is a different conversation and one where the honest first answer is that you need a regulatory strategy before you need a governance platform.
RotaGrant ships no clause map for Healthcare. The engine takes clause maps as data, so one can be authored — by you, by your counsel, or with us — and it will be scored like any other. What this page will not do is imply a mapping that does not exist, because a readiness percentage against an instrument nobody encoded is a number with no denominator.