Mast Labs · Mast Health · mastOS

AI infrastructure built for the reality of regulated healthcare.

Not a chatbot. Not a copilot layered on top of an EMR. The operating layer that makes clinical AI safe, auditable, and production-ready when PHI is in the loop and compliance is not optional.

H001
Live in outpatient
physical therapy
500K+
Autonomous clinical
interactions in production
96%
Resolution rate
sub-1% error rate
7yr
SENTINEL audit
retention target
The architecture

One control plane. Every client, isolated.

mastOS is the platform. Mast Health is the healthcare vertical it powers. TheraLoop and DermaLoop are the clinical fleets. Every client gets a sealed Harbor.

mastOS Control Plane
Provisions · monitors · governs the fleet · Azure · IaC
Mast Health
Healthcare vertical · TheraLoop + DermaLoop fleets
Multi-location
Provider Groups
Future vertical · same control plane · different domain
Harbor 001
Physical Therapy · Live
Own data store
Own Key Vault
Own VNet
Own comms
Own audit trail
Harbor 002
Multi-location · In development
Config-led
New taxonomy
New policies
Same pattern
No cross-Harbor path. Ever.
Harbor isolation

What "isolated" actually means.

Most healthcare AI platforms separate tenants by a row in a database table or a filter in a query. That is not isolation. That is a naming convention. A Harbor is infrastructure-level isolation.

Dedicated data store
Tenant data is not commingled in a shared application database. Each Harbor has its own database instance. A query at one Harbor cannot reach another.
Dedicated Key Vault
Encryption material is segregated by tenant. Customer-managed keys. A key compromise at one Harbor does not expose another.
Isolated VNet
No intended Harbor-to-Harbor network path. Enforced at the Azure resource group level, not by application logic.
Dedicated communications
Tenant-specific communication identity and routing. Patient messaging, SMS, and voice infrastructure are Harbor-scoped.
Independent lifecycle
Provision or remove a Harbor as a discrete Azure resource group. Teardown eliminates tenant resources without touching adjacent Harbors.
PHI de-identification
PHI is de-identified before it reaches any external model endpoint. The intelligence layer operates on protected data pathways, not raw patient records.
When your security team asks
"Is our patient data in the same environment as another organization's patient data?" The answer is no. Not logically separated. Independently provisioned and infrastructure-isolated at the Azure resource group level.
Intelligence engines

Five engines. Each one does one thing.

The AI is not the product. The AI is what makes the product disappear so the patient gets the answer and the compliance team can reconstruct every decision.

MILO
Governed workflows and deterministic escalation
Taxonomy enforcement, protected model boundaries, and three-tier clinical escalation: self-service, urgent human handoff, and critical emergency routing. Context is preserved and summarized at every handoff so nothing is lost between touchpoints.
MIRA
Natural-language operational analytics
Operational intelligence over de-identified analytical data. Generates insights in plain language. Never operates on raw PHI. Analytics that the compliance team can stand behind.
KEEL
Taxonomy-backed clinical documentation
Clinical documentation and encounter workflows structured by domain taxonomy. CPT and ICD-10 tracking. Documentation that reflects how the work actually happens, not how a generic template assumes it happens.
PORTER
Ingestion and event routing
Data movement and orchestration across the Harbor. Governs what enters, what is transformed, and where it goes. The pipeline that keeps PHI where it belongs.
SENTINEL
Audit telemetry, policy controls, and retention
Every policy decision, model interaction, and workflow event is recorded. Seven-year retention target. One-click audit export. The trail exists before the regulator asks, not after.
Escalation logic

Three tiers. Deterministic. No gaps.

The system knows when to act, when to hand off, and when to stop. Every escalation path is defined before deployment. Not improvised at runtime.

ENTRY ENGINE MILO receives request Can MILO resolve? YES TIER 1 · AUTONOMOUS MILO handles it. Resolved within Harbor. SENTINEL logs. Passport updated. NO Clinical flag? YES TIER 2 · URGENT HANDOFF Human takes over. Full context delivered first. SENTINEL logs handoff. CRITICAL TIER 3 · CRITICAL STOP MILO stops. 911 routed. Audit trail sealed immediately. SENTINEL captures full sequence. SENTINEL Every decision logged. · Timestamp + session summary · Escalation trigger recorded · Full context preserved · 7-year retention target · One-click audit export The trail exists before the regulator asks. AUDIT LAYER
What this means for compliance
Every escalation trigger, handoff event, and emergency routing decision is captured in SENTINEL with a timestamp, session summary, and full context. No reconstruction after the fact. The record exists before the regulator asks.
Patient Passport

The record that follows the patient. Not the system.

Every engine, every Harbor, every fleet feeds a single source of truth. The patient owns it. The provider reads it. The system maintains it.

The Center
Patient Passport
Portable · Patient-owned · Always current
MILO feeds
Every interaction, escalation, and care touchpoint. Session summaries. Escalation history. Communication log.
KEEL feeds
Clinical documentation. Encounter notes. CPT and ICD-10 codes. Unsigned session flags. Treatment history.
SENTINEL feeds
Audit trail. Policy decisions. Override events. Regulatory-ready export. Seven-year retention.
Patient controls
Who sees the record. When access is granted. When it is revoked. Free at every tier. Works outside the Mast Health network.
Provider reads
Pre-populated intake. Clinical notes with audit trail. Full history on first visit. No re-entry of information the patient already provided elsewhere.
System maintains
Normalized across providers and networks. Insurance and ID captured. Billing history. Discharge summaries. PCP handoff packets.
What this solves
Most healthcare systems require the patient to be the integration layer — carrying paper records, repeating their history at every appointment, losing context every time they change providers. The Passport removes that burden permanently. The record travels. The patient does not have to.
Audit and governance

The questions your legal team needs answered.

SENTINEL is built so the answer to every compliance question is yes before anyone asks.

Data provenance
What data did the model see?
Every model interaction is logged with the exact context that reached it. PHI de-identification is enforced at the pipeline level before any external model endpoint is reached.
Decision audit
What decision did it make and why?
Workflow decisions, escalation triggers, and model outputs are recorded with full operational context. The trail can be reconstructed without asking the vendor to explain its own system.
Incident containment
What happens during a data incident?
Harbor isolation means a tenant incident is contained within that Harbor's boundary. The blast radius is defined by infrastructure, not by application logic or access controls.
Override and control
Who can override the system?
Human escalation paths are deterministic and governed. The system knows when to act, when to recommend, and when to stop and hand off to a clinician. Human-in-the-loop is architecture, not afterthought.
Retention
How long is the audit trail retained?
Seven-year retention target. One-click audit export. Telemetry is structured for review by a compliance officer without requiring a data science degree or vendor assistance.
Regulatory readiness
Can we answer a regulator's questions?
The audit trail is designed to survive litigation discovery and regulatory inquiry. No reconstruction after the fact. The record exists from the moment the interaction begins.
Patient Passport

The patient carries their record. Always.

The platform builds the infrastructure. The Passport puts it in the patient's hands.

Your health record. Your control.
The Patient Passport is a portable, patient-owned health record that travels across every provider, every system, and every care episode. Not a portal you log into once and forget. A living record that the patient controls — what is in it, who can see it, and when that access ends.

Patients decide who gets access. Providers see what the patient chooses to share, nothing more. The Passport works inside the Mast Health network and outside of it. It is free at every tier. It is the thing that should have always existed.

In 2008, the architecture for a connected prescription network was sketched in a notebook. The sell line at the bottom of the page: "Being in the loop will save lives." The Patient Passport is what that line became.
Mast Health fleets

The same infrastructure. Different domain, different taxonomy.

Each fleet is a named product for a clinical vertical. The Harbor model is the same. The taxonomy, workflows, and engines are configured for the domain.

TheraLoop
Physical Therapy Fleet
Harbor H001 is live in outpatient PT with a clinical partner. MILO coordinates care. KEEL documents encounters with CPT and ICD-10 taxonomy. MIRA reports on clinical and operational performance. SENTINEL keeps the audit trail.
H001 · Live in production
DermaLoop
Dermatology Fleet
In development. Same Harbor architecture, same governance posture, same engines. Different domain taxonomy and clinical workflows.
In development

Ready to talk about what this means for your organization?

Whether you are evaluating AI infrastructure for a healthcare network, advising on compliance posture, or exploring what governed clinical AI looks like in production — the conversation starts here.

Schedule 30 minutes ara@mastlabs.ai