How Lens handles your patients’ data

Lens checks charts for coding problems. Here is exactly what it reads, what it sends, and what we keep.

What Lens reads

Lens works only on Practice Fusion chart pages.
It reads the chart you have open: the patient’s name and record number, age and sex, diagnoses, medications, labs, and the visit note when one is open.
It reads what’s on your screen. It doesn’t connect to Practice Fusion behind the scenes.
Lens is read-only. It never edits your chart, signs a note, or submits a claim.
It doesn’t run on other websites, and it can’t read your other tabs.
You can pause Lens from the Cortex icon. While it’s paused, it doesn’t check charts.

Before a chart is sent, Lens removes your patient’s name and record number, right in your browser.
It also removes phone numbers, email addresses, street addresses, and Social Security numbers.
It removes dates written like 3/14/2026 or March 14. Ages over 89 are sent as 90.
This step isn’t perfect. Other people’s names in a note, like a family member or another doctor, can get through. So can some date formats.
Diagnoses, medications, and lab results are sent as they appear, because Lens needs them to check the chart.

The chart goes over an encrypted connection to Cortex’s servers in the United States.
Our servers send it to Claude, an AI model made by Anthropic, which does the check.
Anthropic doesn’t use this data to train its models. It deletes it within 30 days, unless it must keep it longer to investigate misuse or to follow the law.

We keep a copy of each checked chart, after the details above are removed, along with what Lens found. We use these copies to check and improve Lens’s accuracy.
If a chart ever arrives without that step, for example from an out-of-date copy of Lens, we erase its text within 7 days.
Our database provider, Supabase, says it encrypts stored data with AES-256.
In your browser, Lens keeps recent results in memory for up to an hour.

Your team signs in with a link we email, not a password. The link expires after 24 hours.
Only people your practice invites can get an account.
The Cortex website signs you out after 30 minutes without activity.
Stored charts aren’t shown in your practice’s Cortex account. Only Cortex platform administrators can open them.
We keep a log of sign-ins, invitations, and role changes.

We’re moving chart checks to Google Cloud, under a business associate agreement (BAA) we’ve signed with Google.
After the move, full chart copies will live on Google Cloud, and our other systems will keep only codes and counts.
We’re preparing a BAA for every practice, to take effect when the move is done.

If you think you’ve found a security problem, email Email us. Please don’t include patient names or other patient details.

Last updated September 28, 2026.