Private by default
Your care record is not automatically enrolled in model training.
TalkDoc Private AI
TalkDoc’s advantage is clinician-led Medicaid care with measurable outcomes. Private AI exists to free clinician time, extend quality to more people, and return value to members who choose to contribute—under separate consent and clinician supervision.
Care is available without contributing data. Interest is not consent. Participation is never assumed.
choiceprivacyvalueThe choice standard
The planned contribution program is designed around a clear offer for a specific purpose. Clinical use of a model is a second, separate choice.
Your care record is not automatically enrolled in model training.
See the data involved, purpose, duration, recipient, and payment logic before choosing.
The planned consent center will keep a human-readable record of every decision.
You should know what can stop going forward and what cannot be undone once a completed training run is incorporated.
The direction
A licensed clinician owns the relationship, decisions, and follow-through.
A future offer would identify the specified, minimized information, the privacy standard, and the exact terms.
Approved workloads are designed to process approved data inside confidential computing.
Models must earn their way into care through technical, clinical, privacy, and bias evaluation.
A contribution is intended to improve a domain model, not create a member-linked model. Under a separate clinical choice, a validated capability may use relevant current context to help your clinician—not act as an autonomous doctor.
If an eligible contribution creates commercial value, TalkDoc's goal is direct member compensation with a clear receipt. The intended product is model capability or aggregate results—not participant records.
IronEgg architecture
Confidential computing reduces who can inspect data while it is being processed. Attestation can help verify what code is inside. Encryption and short-lived keys reduce exposure outside that boundary.
Security architectureProtected memory is designed to be isolated from the surrounding host and ordinary operators.
The architecture can produce evidence about the running image for an approved verifier. Direct browser and device verification remains staged.
Requests and responses are designed to cross the boundary as ciphertext.
Keys are created for a running environment and destroyed on shutdown rather than stored as ordinary files.
Scope matters: not every TalkDoc service runs inside IronEgg. Scheduling, billing, Community, phone workflows, and some clinician tools use separate systems with their own controls. GPU attestation, client-side verification, OHTTP routing, and independent assurance remain staged work.
Personalization, without pretending
Clinicians deliver care. AI may help collect information or draft material in gated workflows.
With separate permission, eligible contributions may help improve domain models inside protected infrastructure.
Under a separate clinical choice, a validated capability may use relevant current history and goals to support the member's clinician. This is distinct from contribution to domain-model training and does not independently diagnose, prescribe, or treat.
Product truth
California eligibility and clinician capacity apply.
Pseudonymous support; Community posts excluded from training by default.
Confidential-compute architecture exists; availability varies by workflow and environment.
Plan-facing, privacy-protected aggregate reporting; availability remains limited.
No general availability or guaranteed payment today.
Requires consent design, model evaluation, clinical governance, and legal review.
Non-negotiable guardrails
TalkDoc care is available today for eligible California members. The paid contribution and member-specific model program remains in development.