BastionGPT

GDPR overview

The site never claims GDPR compliance and never denies it. What it names is HIPAA and 42 CFR Part 2 in the United States, FERPA, PIPEDA and PHIPA for Canada, and the Privacy Act 1988 with the Australian Privacy Principles. Section 3.3 of the terms commits only to the applicable data protection laws of the United States, Canada, Australia and any other jurisdiction where the company operates. The privacy policy, effective 27 April 2026, nevertheless opens a Data Subject Rights section modelled on the GDPR: access, rectification, erasure, restriction, portability, objection and withdrawal of consent, all exercised at legal@bastionintelligence.com. No Article 27 representative is designated, no European entity or address appears anywhere, and no European hosting region is offered. A detailed CCPA regime covers California residents, including recognition of the Global Privacy Control signal.

Who owns the data?

Under the terms of use, users keep every right, intellectual property included, in the data they put into BastionGPT's chat and transcription services, and the vendor states plainly that it claims no ownership of that material. It grants itself only a limited licence to host, store, transmit, display and process the content, and strictly in order to deliver the service. It undertakes not to sell that data, license it or exploit it commercially. One exception is worth knowing: feedback and suggestions about the product carry a perpetual, irrevocable, royalty-free and sublicensable licence, which the terms treat separately from customer content.

Reuse rights

Because users retain all rights in what they enter and in what the service returns, they may reuse those outputs freely — in a patient record, a claim file or a legal brief — without asking permission. The counterpart sits on the vendor's side: data entered into the chat and transcription services is contractually excluded from training, enhancing or improving any AI model, and is never sold, licensed or disclosed to third parties for those purposes. It does not reach OpenAI or the other model providers, which work from a secured deployment. Of the thirteen published sub-processors, only Microsoft and Google touch customer content; the marketing, advertising, payment, scheduling and affiliate providers never do. Every draft still has to be reviewed, corrected and signed by the clinician before it enters the medical record.

Data retention & training

Hosting summary

Data sits on Microsoft Azure infrastructure, described as hardened and covered by a business associate agreement. Storage and processing take place in the United States by default; customers with a Canadian or Australian billing address have their sensitive data resident in their own country, and the API offers the same three regions, with Quebec for Canada. No European region is available. Content is encrypted with AES-256 at rest and TLS 1.2+ in transit, segregated by tenant, and protected by role-based access control and audit logging. The infrastructure providers hold HITRUST CSF certification and SOC 2 Type II attestation with annual audits; the vendor states that its own equivalents are still in the readiness phase. An external offensive-security firm runs penetration tests at least annually, with additional tests around major platform changes, and static and dynamic code analysis runs on every change. The vendor reports no reportable breach of protected health information in three years of operation.