Yes. BAA-ready workflows, PHI handling protocols, and de-identification at intake. Every environment that touches PHI runs under independent SOC 2 Type II controls; access is named-individual scoped and audit-logged. PII redaction happens before annotation begins, with verification at multi-pass review. Cross-border data transfer agreements are provided on request, and EU/UK residency options are configurable per engagement. We can provide the BAA, SOC 2 attestation summary, and de-identification policy for your procurement review before any data moves.

Audit trail standards align with MHRA Good Machine Learning Practice guidance and FDA Software as a Medical Device principles. Documentation packages on request — escalation protocols, reviewer logs, gold-set provenance, and disagreement-resolution records included. Each annotation carries provenance metadata: annotator ID, reviewer ID, timestamp, taxonomy version, and any escalation path. The package is the audit trail your regulatory affairs team needs without reassembling it from operational logs. Existing clients have used these artefacts in FDA 510(k) and MHRA submissions; we can walk through the documentation structure on request.

Three reviewer levels per batch with named QA leads. L1 annotators tag against your taxonomy; L2 reviewers check consistency and edge cases; L3 QA specialists run senior SME review on ambiguous frames and apply disagreement-resolution. Gold sets curated by your clinical team are the anchor — every batch QA'd against them, with drift detection running across the programme. Edge cases route to named clinical SMEs with disagreement-resolution captured for audit. The 96% staff retention means the L3 reviewing the first batch is reviewing the last — clinical judgement accumulates inside the team.

Per your requirements. Some healthcare partners need full data residency — infrastructure inside the country, no PHI crossing borders, contracts and audit trails to match. Others run anonymised pipelines — PHI stripped at intake, only de-identified records reach annotation, no personally identifiable health information leaves the country at all. We operate both models, either against established compliance frameworks our partners already use or bespoke to your stack, and every engagement runs under the local laws that apply — HIPAA, UK GDPR, EU GDPR, and country-specific health-data regimes. This is well-trodden ground for us; the operating pattern is agreed before any data moves.

A scoped audit before any data movement: NDA and BAA first, then a sample batch on your taxonomy returned with a multi-pass QA plan, accuracy benchmark, and delivery-ready exports. The sample runs through the same three-tier review your production work would — L1 → L2 → L3 with clinical SME escalation. We return the audit pack in 48 hours, including provenance metadata and a programme recommendation. If you scale, a 4-week paid pilot follows — production-grade work at limited scope, validating process, accuracy threshold, and compliance posture before production volume. The audit is unpaid; the pilot is paid because it is real production work.