Security and trust
Built like clinical infrastructure, because it is.
Photographs of skin are protected health information. Constellation treats them that way from the first line of code, not as a compliance checkbox after the fact.
HIPAA posture from day one
Constellation is built on HIPAA eligible infrastructure, with protected health information encrypted in transit and at rest. Business associate agreements with our vendors and with each clinic are signed before any real patient data goes live. Privacy is not a tier we upgrade to. It is the default architecture.
Every access is audited
Every capture, every view of a photo, every comparison and every configuration change writes to an append only audit log, including who, when and from where. Failed access attempts are logged too. The trail cannot be edited or deleted, by anyone.
Consent is per photo, owned by the patient
Consent is not a blanket checkbox at intake. It is recorded per photo, visible to the patient in their portal, and revocable. A photo without consent standing behind it does not get used. Ever.
Access is scoped by role
Row level security enforces who can see what at the database itself, not just in the interface. A medical assistant, a doctor, a practice owner and a patient each see exactly their slice, and nothing else.
Photo links that expire
Patient photos are never public addresses. Every image is served through short lived signed links that expire in minutes and are never written to logs.
The software never writes the chart
The deterministic core, meaning measurements, alignment and history, is exactly that: deterministic and tested. Assisted surfacing suggests and ranks. It cannot diagnose, it cannot commit to the record, and it cannot bypass the dermatologist's sign-off.
The boundary
Constellation stops at the end of the exam.
The note, the orders and the biopsies stay in your EMR. Constellation is not an EMR. It is the reference layer beside one.
EMA by ModMed, EZDerm, and others
Your data
The record belongs to the practice and the patient.
The longitudinal record Constellation builds is your practice clinical asset and your patients history. No selling data. No training foundation models on your patients photographs without explicit, separate consent. Leaving is as clean as staying.
Questions your compliance officer will ask?
Good. Ours asks them too. A security review is part of every founding practice conversation.
Request a founding practice seat