Blues
AI that stays in the building
Most clinical AI works by sending the chart to someone else's server; Blues runs on the clinic's own machine instead.
The default design has a cost you did not agree to
Almost every AI assistant sold to practices right now is an API call. A staff member types a question, and the context needed to answer it, which is patient information, leaves the building.
That is not a scandal. It is just architecture, and it is the easy way to build. But the practice ends up inheriting things it never chose.
You inherit a vendor's retention policy. You inherit their logging, which means PHI sitting in a system you cannot audit on demand. You inherit their uptime, which means the assistant can vanish on a Tuesday afternoon for reasons nobody at your front desk can do anything about. And you inherit a per-token bill that scales with how useful the thing turns out to be.
Blues runs where the data already is
Blues is the assistant inside LogBlues. It runs against a model on the clinic's own machine, through a local model runtime. There is no hosted API on the other end of the conversation.
Inference happens on hardware you control. That single decision removes a category of problems rather than mitigating them:
- No per-token bill. Usage is not a line item, so nobody has to ration a tool that helps.
- No PHI in a vendor's logs. There is no egress, so there is nothing upstream to retain, subpoena, or breach.
- No upstream outage. If the internet goes down mid-shift, Blues is still there.
Conversations live only on that device. They are the user's to keep or to clear, and clearing them means they are gone, not archived somewhere on your behalf.
An assistant with no special privileges
Local inference solves where the data goes. It does not, by itself, solve what the assistant is allowed to touch. Those are separate problems, and a lot of tools quietly get the second one wrong.
Blues is bound by exactly the same permissions as the person using it. It cannot read or write anything that user could not read or write on their own. There is no service account behind it with a wider view of the practice, and no path where asking the assistant nicely returns a record the RBAC model would otherwise deny.
Every write action asks first. Blues is part of the security Exosystem (LMLSE), not an exception carved out of it, and the whole product is HIPAA-ready from day one.
It does not pretend
The failure mode that actually erodes trust is not a data breach. It is an assistant that says it did something it did not do.
Ask Blues to book an appointment and it does not report back that the appointment is booked. It opens the real scheduling form, filled in and ready for review. Ask it to create a task and you get the real task form, populated. Nothing is saved until a person looks at it and confirms.
The same principle applies to what it says. Blues admits uncertainty instead of guessing confidently, including about acronyms, which in this industry can mean three different things depending on who is in the room. A tool that says "I am not sure what you mean by that here" is worth more than one that produces a fluent, wrong answer at speed.
To be clear about scope: Blues assists with clinic work. Drafting, finding, summarizing, answering questions about how your practice is set up. It is not a clinical decision tool and does not present itself as one.
Personality is a feature, not decoration
Blues has a personality slider that runs from Professional to Expressive. The register changes, but the reasoning behind it does not.
People do not use tools they dread. Software that arrives in a clinic with the tone of a compliance form gets used exactly as much as it has to be and no more. Let the person at the front desk pick how their assistant talks to them at 4:50 on a Friday.
The privacy properties do not change with the slider. Local inference, the user's own permissions, confirmation before every write, conversations that stay on the device. Expressive is still bound by the Exosystem.