SALVEA™
Sovereign by design · enterprise by default
Hospital Governance System (HGS). The EHR holds the patient's record. The HGS governs how AI may touch it.
Every model and agent your hospital runs, yours, ours, or any vendor's, answers through your own infrastructure under one set of rules: role-based access, human approval where it matters, and an audit trail that holds up to scrutiny. Patient data leaves the building only when you decide it may, and never without a record.
The AI assists; clinicians decide.
The Hospital Governance System
Admitting a new tool, keeping its record, checking it in service, holding agents to the same rules, and showing what care gets back. SALVEA does all five, inside the hospital.
01
How a new tool enters the hospital.
A request names the tool, its vendor, what it will touch and who wants it. The intake review reads the vendor's documents, gives a first risk tier and routes the decision to the named approvers. No forms passed around by email.
Intake review · Approvals
How a new tool is admitted →02
One record of every tool, built or bought.
Each tool carries its version, vendor, risk tier, where it runs, who may use it, its evaluations and every approval behind it. A site can approve a tool itself or inherit its health authority's decision.
Models · Model Store
03
Is every tool still safe and performing?
Performance, safety and impact tabs per tool, nightly self-tests, health checks and alert rules written as plain sentences. Clinician corrections are counted per day and per unit.
AI estate · Monitoring
04
Agents are governed like models.
Each agent declares its tools and access scopes. What it may read, what it may do and what must stop for a clinician are set per agent, and every call is recorded.
Agents · Connectors
05
What the hospital gets back for its AI.
Use by department, role and clinical workflow. Hours returned to clinical work, approval rates and held actions, each figure naming the records it was counted from. A board report in one download.
Value · Board report
Governance that sits outside the call can only watch. SALVEA sits in the path of every call, so it can act on the rules as well as report on them.
| Governance from the outside | SALVEA, in the path of every call |
|---|---|
| Records that a tool answered | Decides which tool may answer and for whom, before the call is made |
| Alerts when an answer looks wrong | Withholds an answer with no approved source, and says so |
| Reports what an agent did | Holds a consequential action until a named clinician approves it |
| Logs activity in a vendor's cloud | Runs inside the hospital; an outbound call happens only under a rule, and each one is recorded |
| Keeps an activity log | Keeps a hash-chained ledger: a removed or edited row breaks the chain |
01 · Without governance
A hospital can buy a model from any vendor and have it answering questions inside a week. What it cannot buy is the answer to who asked, what was retrieved, which policy applied, and who approved the result. The model arrives. The rules around it do not.
Five questions most hospitals cannot answer today:
What that costs:
None of this is an argument against AI in hospitals. It is an argument against ungoverned AI in hospitals.
02 · With SALVEA
SALVEA sits between every model the hospital runs and the people who rely on it. Yours, ours, any vendor's, on your hardware or in a cloud you approve: every call runs under the same rules and the same audit trail. Patient data stays in the building unless you decide otherwise. The AI assists; clinicians decide.
The vendors do not govern your hospital. You govern the vendors.
03 · For the people accountable
One flat licence per building. Nothing metered. No per-user, per-token or per-note fees. Buy the hardware or lease it month to month. If you switch on a cloud model, its usage is your own contract with that vendor. The time clinicians get back on documentation, discharge summaries and record lookups pays for the platform, and with no meter there is no rationing and no shadow AI.
Every answer leaves a record. Who asked, which model, what it read, who approved. Patient data stays inside by default; anything that tries to leave without a policy is blocked and logged. A cloud model, if you approve one, runs under the same record. One export answers your privacy review.
Single tenant, inside your network, running unaided by day 30. Any model that speaks standard endpoints works, on your own hardware or, if the hospital approves it, a cloud model such as Claude or GPT, governed the same way. It launches from inside the chart. One command centre shows every department, ward, device and model.
The whole hospital on one screen, on demand. Zoom out for the live picture; drill into any patient journey, alert or audit trail; ask a plain-language question and get a grounded answer with its sources. The view your board asks for, without waiting for the monthly meeting.
Canada
One set of rules across every site in the province. Each hospital runs its own tenant inside its own boundary; the health authority sets policies, tiers and approved models once and sees every site together. Data stays in the province, on hardware the institution owns or leases. If the authority approves a cloud model, it approves it once and every site inherits the decision. The evidence pack answers each site's privacy impact assessment under PIPA, FIPPA or PHIPA in one export, and the per-building licence keeps the budget line predictable across a multi-year plan.
United States
One set of rules across every hospital in the system, in every state. Picture a twelve-hospital system across three states: each hospital runs its own tenant inside its own walls; the system sets policies, tiers and approved models once; compliance sees every site together. Patient data stays in the facility by default, so the business associate footprint stays small and each state's privacy rules apply per site. If the system approves a cloud model under its own business associate agreement, every hospital runs it under one policy. Every answer carries its sources, giving clinicians an independent basis to review and giving compliance the record a HIPAA audit asks for.
On your hardware by default · in the cloud by decision
SALVEA runs inside the building. If an institution chooses to use a cloud model, it runs under the same policies, roles and audit trail as everything else, and what may reach it is the institution's decision.
04 · Core pillars
Models, retrieval and audit stay inside the institution's boundary unless you decide otherwise. Egress is a policy you switch on, not a default you discover.
EGRESS_PROTOCOL: OFF_BY_DEFAULT
Sensitive actions open an approval request with the exact content and the triggering policy. Nothing is filed on its own.
HUMAN APPROVAL REQUIRED
Every message, retrieval, action and approval writes an audit event: who asked, which model, what was retrieved, how the answer was formed.
AUDIT_STREAM: IMMUTABLE
Bedside edge, unit node, hospital server room or provincial data centre: each model carries its deployment location and guardrail tier.
DEPLOY_TIER: CRATON_FLEET
A new system in the hospital
A hospital already runs an EHR for the patient record, a LIS for the laboratory and a PACS for imaging. None of them governs the models and agents now answering clinical questions: who may ask, which model may answer, what may leave the building, and who signed the decision. That is the Hospital Governance System, and SALVEA is one.
EHR
Electronic Health Record
The patient's record
LIS
Laboratory Information System
Laboratory results
PACS
Picture Archiving and Communication System
Imaging
HGS
Hospital Governance System
How AI may touch any of them
05 · Three layers, one institution
Hardware, runtime and clinical products, each owned by the institution, each auditable end to end.
Clinical products the institution chooses to run, each with its own evidence, evaluation history and guardrail tier.
The governed runtime: who may ask what, which model answers, what needs a clinician's decision, and the record of all of it.
Compute that lives in the hospital: bedside devices, unit nodes and the server room, monitored as one fleet.
06 · What runs on it
Answers only from the approved library, with a receipt for every answer and "no source" when the library has none.
Governed by SALVEA. Audited end to end.
Note drafting and intake review; the clinician signs, nothing files itself.
Governed by SALVEA. Audited end to end.
On your hardware or in the vendor's cloud, once approved. Registered, evaluated, tiered and health-checked before routing will use it; version changes announced to clinicians before they take effect.
Governed by SALVEA. Audited end to end.
Same rules, same audit trail, no exemptions.
Governed by SALVEA. Audited end to end.
Every product above, including ours, sits in the Model Store with its evidence, evaluation history and guardrail tier.
See it
Synthetic data only.
