# Access & Data Handling

Part of the HebrewCore documentation. Web: https://hc.itsbaba.com/docs#medical-access · Whole docs: https://hc.itsbaba.com/docs.md · Index: https://hc.itsbaba.com/llms.txt

> The Clinical API is enabled per account under a data processing agreement (and a BAA for US covered entities). Keys need the `medical` scope; other keys get `403 scope_required`.

- **Server to server only.** A request carrying a browser `Origin` header is refused with `403 server_only`. Never put a medical key in a browser or app.
- **Nothing is stored.** Only character counts are kept for billing. Responses carry `Cache-Control: no-store` and `X-Content-Stored: false`.
- **Names and identifiers never reach the model.** Values passed in `redact_terms`, and record numbers, phone numbers, SSNs and emails found in the text, are sent to the model as blank placeholders and put back afterwards. They are also left out of the `spans` list in responses.
- **Dedicated model access.** Medical traffic goes directly to the model provider under contract, with storage turned off. It never passes through a model reseller or a logging gateway.