The trust case is unusually important because Stratum can process protected health information and perform actions inside clinical-administrative workflows. Its current site says patient data is encrypted in transit and at rest, stored in the United States, not used to train shared models, and handled under a signed Business Associate Agreement before live PHI is processed.1 The HIPAA Notice, effective August 22, 2026, separately describes Stratum Industries' obligations around PHI, permitted uses/disclosures and breach notification.7
The website Privacy Policy, effective September 1, 2026, is narrower: it covers website/demo contact data and explicitly sends demo-call recordings and transcripts to the HIPAA Notice instead.8 This separation is useful, but the public documents do not substitute for a buyer reviewing the actual BAA, security controls, subprocessors, retention terms and access model for its production deployment.
The site includes performance figures and examples, but its Terms state that site figures and examples are illustrative.4 They are therefore not treated as independent reliability or ROI evidence. Y Combinator confirms Stratum Industries as an active Summer 2026 company, but its profile still describes the earlier government application-review product and is not evidence for healthcare-agent performance.6 The fixed AiToolMap source panel did not surface a current exact-product independent review or numeric rating for the healthcare surface.