Skip to main content

Warnings, Limitations, and Regulatory Considerations

It is crucial to understand the limitations and potential risks associated with using Phlox. This project is provided for educational and research purposes only. It is NOT intended for direct clinical use in its current state without rigorous validation, security hardening, and adherence to all applicable regulations.

Usage Warnings and Disclaimers​

  1. Experimental Software: Phlox is an experimental, personal project. The code is under active development and may contain bugs, inconsistencies, and security vulnerabilities. It has not undergone formal testing or quality assurance processes expected of medical devices.

  2. AI Hallucinations and Inaccuracies: Phlox relies on Large Language Models (LLMs) for various functions. LLMs are known to hallucinate, meaning they can generate outputs that are plausible but factually incorrect or nonsensical. This is especially true for smaller, locally-run models.

    • Critical Verification: ALL AI-generated outputs from Phlox (clinical notes, summaries, correspondence, reference searches, chart insights, etc.) MUST be independently verified by qualified medical professionals using trusted, primary sources. Do not rely solely on AI-generated information for clinical documentation.
    • Risk of Misinformation: AI-generated content may contain inaccurate medical information or misinterpret clinical context. Using unverified AI output in clinical practice could lead to patient harm.

  3. Not a Certified Medical Device: Phlox is not a certified medical device and has not been evaluated or approved by any regulatory bodies (e.g. FDA, TGA, MHRA). It most likely does not meet the regulatory requirements for medical devices in any jurisdiction.

  4. No Regulatory Compliance (HIPAA, GDPR, TGA, etc.): Phlox, in its default configuration, does not comply with regulations such as HIPAA, GDPR, or TGA, or any other patient data privacy or medical device regulations.

    • Security & Privacy: Phlox is a single-user, local-first application. It is not a hardened, multi-user clinical system. While it does include some security controls — encryption at rest (SQLCipher), an audit log of API activity, rate limiting, security headers, and optional proxy authentication (see Security) — these are not a substitute for the comprehensive administrative, physical, and technical safeguards required for regulatory compliance.
    • Audit logging is basic: the audit log captures request metadata (method, path, status, actor, timing) but not a full compliance-grade audit trail with immutable retention or tamper-evidence.
    • Database Encryption: database encryption protects data at rest but is not, by itself, a comprehensive security measure.
    • Transcription Data: consider the privacy implications of your chosen Whisper transcription service, especially if using cloud-based APIs.

  5. Authentication and Access Control: Phlox has no built-in user accounts or authentication by default. Options:

    • Docker/web: no auth unless placed behind a reverse proxy with proxy authentication enabled.
    • Desktop (Tauri): protected by a random local bearer token generated by the shell, plus a database passphrase.

    Exposing Phlox to the public internet without authentication (ideally behind a reverse proxy or VPN) is highly discouraged and poses a significant security risk. On desktop, the database passphrase must be re-entered on every launch — Phlox deliberately does not cache it in the OS keychain, so that physical access to the machine does not grant access to the database.

  6. MCP Server and External Tool Security: When connecting external MCP servers or enabling built-in tools that call external APIs (PubMed, Wikipedia):

    • Patient data may be transmitted to third-party services depending on configuration.
    • The per-server "Allow sensitive data" toggle (off by default) strips patient-identifying information from MCP arguments, but is best-effort and not guaranteed to catch all PHI.
    • External services may log, cache, or retain transmitted data.
    • You are responsible for ensuring that any external service complies with applicable privacy regulations.

  7. Intended Use - Educational and Personal: Phlox is primarily intended for:

    • Educational purposes: to explore the potential of AI in administrative workflows and learn about LLMs and related technologies.
    • Personal use: for experimentation, research, and non-clinical exploration of AI-assisted note-taking and information management.
    • Development and Research: as a platform for further development, research, and contribution to open-source medical AI tools.

By using Phlox, you acknowledge and accept these warnings and limitations. You assume full responsibility for any use of Phlox and agree to use it ethically, responsibly, and in compliance with all applicable laws and regulations.

If you are unsure about any aspect of these warnings or the regulatory implications of using Phlox, DO NOT USE IT in a clinical setting without obtaining professional advice and implementing all necessary safeguards.