Security

LUCID by HORUS NeuroTechnologies
Effective date: October 6, 2026

LUCID is built for clinicians, so it is built to protect them and their patients. This page describes how LUCID is secured and how to report a security concern.

1. Designed to work without patient identities

LUCID removes names, record numbers, dates and other identifiers from notes in your browser, before any text is sent. The clinical details of a case are used only during your session to produce your results. They are not saved to your account or to our database, and they are not used to train models.

2. Where LUCID runs

LUCID runs on Google Cloud in the United States, on managed services for the application, the account database and the storage of settings and keys. Connections to LUCID use HTTPS, and our hosting provider encrypts stored data at rest. Settings and keys are held in a secrets manager rather than in code.

Passwords are stored only as salted, one-way hashes (PBKDF2-SHA256 with 600,000 iterations).
After five wrong passwords an account locks for 15 minutes, and repeated attempts from one network are limited.
New accounts confirm their email address with a six-digit code that works once, for 30 minutes.
Password reset links work once, for 30 minutes, and requests are rate-limited.
You can sign in with Google instead of a password.

4. Payments

Payments are handled by Stripe on its own pages. Card details never reach LUCID's servers.

5. Access and operations

Access to production systems is limited to authorized members of the HORUS team who need it. Technical logs are kept for a limited period, generally about 30 days, and the software LUCID depends on is kept up to date.

6. Clinical content integrity

Every note and PDF carries the LUCID version and the version of the guideline content behind it. Changes to recommendations are reviewed by two clinicians, and anyone can report an error from inside LUCID; reports that could affect patient safety are reviewed within one business day.

7. Incidents

If we learn of a security incident, we investigate it promptly, take steps to contain it, and notify affected people and authorities as the law requires.

8. Report a vulnerability

Email horusneurotechnologies@gmail.com with "Security" in the subject, and include enough detail for us to reproduce the issue. Please do not access other people's data, disrupt the service, or share the issue publicly before we have fixed it. We acknowledge reports within three business days, and we will not pursue good-faith research that follows these guidelines.

9. Contact

HORUS NeuroTechnologies LLC, United States
Email: horusneurotechnologies@gmail.com