Security & privacy.

Written for the person who has to sign off on a new tool as much as for the clinician who will use it. Reviewed 14 August 2026.

---

Where the data is

Hansym is a desktop application. The publisher’s score-report PDFs, your blank report template, the generated report and its audit record are all ordinary files on the Windows computer running it. Extraction, review and generation happen in that process, on that machine. There is no Hansym cloud service that holds assessment or report data, and no account into which such data could be uploaded.

The one thing that is transmitted

Hansym is licensed per computer, and it checks that licence. That check is the application’s only outbound network call. It goes to our licensing server and carries exactly this:

Both columns are pinned by an automated test in the product’s own test suite. It captures every request the licensing client can emit and fails the build if a field, query parameter or header outside the allowlist appears, or if the machine’s hostname or username turns up anywhere in the traffic. A second test loads the licensing code in a fresh interpreter and asserts that doing so does not pull in the modules that handle report data, so that data cannot reach the licensing layer by construction. These are our tests, honestly described: they are a regression guard, not an independent third-party audit, and we do not claim otherwise.

The data flow, in one pass

1. In: digital publisher score-report PDFs, and your practice’s blank Word template — both read from your own disk.
2. On the machine: each PDF is identified from its contents, Hansym extracts only the fields it has been verified to read for that assessment, and anything unverifiable is set aside for review.
3. Out: a dated copy of your template with the mapped score cells filled, and an audit record beside it listing what was written and what needs review. Both land in your Documents folder, under Psych Reports, on your disk.
4. Sideways, separately: the licensing handshake described above. It runs on its own path, carries none of the material in the first three steps, and cannot reach it in code.

How scores are handled

No generative AI touches a score. Each supported assessment has its own fixed rules for the layout of that publisher’s report, and classification bands are computed from fixed score ranges rather than read from whatever the PDF prints. Nothing is inferred, completed or smoothed over.

That is a design boundary, not a proof of correctness. Software that follows fixed rules can still contain defects. What follows from the design is narrower and more useful: Hansym will not invent a number, and when it cannot establish one it says so.

What happens when something cannot be verified

Unverifiable values are routed to the run’s review list and left for you. An ambiguous battery — contradictory form markers, a destination that does not resolve, a duplicate destination — stops before any file is created. A measure the source reports as not administered is left untouched and noted, never filled in. And every generated report is accompanied by an audit record of what was written and what was set aside.

Your template

Hansym never writes to your managed blank template. Each run copies it to a new dated file and writes only into the cells your prepared template maps. Unrelated paragraphs, tables, styles and pre-filled cells are left exactly as they were. Generated reports also do not inherit the template’s document author: the author and last-modified-by names, along with the title, subject, keywords, category, description and status fields, are cleared on output.

Two things Hansym does not clear: the Company and Manager fields, which Word stores in a separate set of document properties, and any tracked-change authors or comments left in the template. Keep those clean in whatever template you supply, and we will check them with you at onboarding.

Treat the outputs as PHI

The generated report and its audit record contain client data. Store them somewhere access-controlled, like any other clinical record. The same applies to the optional extraction cache, which is written beside the output and holds extracted scores; it is off unless you turn it on, and it is safe to delete at any time.

HIPAA and business-associate obligations

The factual position is the one described above: Hansym does not receive, maintain or access the assessment or report data it processes. That data stays on the Windows computer, and only the licensing metadata listed above reaches our licensing server.

Hansym does not make or guarantee your practice’s HIPAA compliance. That is your own programme, and it covers far more than one desktop tool. Whether this data-access architecture changes any business-associate obligation is a question for your compliance counsel — we will give them the allowlist, the test that pins it, and a straight answer to anything else they ask.

Licensing, offline behaviour and releases

Licence state is stored per user on the machine and encrypted at rest with the Windows Data Protection API — the encryption built into Windows, tied to that user account on that machine. Validation refreshes periodically, and Hansym keeps generating reports for up to 14 days without reaching the licensing server. After that, generation pauses until it can. Expiry restricts report generation and nothing else — your templates, reports and audit files are ordinary files and stay where they are.

Production releases are built and signed in an automated process: the application is signed through Microsoft’s Azure Artifact Signing service using short-lived federated credentials rather than a stored certificate key, carries an RFC 3161 timestamp, has its Authenticode signature verified in the same job, and ships with a SHA-256 checksum you can compare against the file you received.

Boundaries worth stating plainly

Windows only. Digital publisher PDFs only — there is no OCR, so a scanned or photographed report cannot be read. No generated clinical narrative of any kind. And unsupported assessment forms stay unsupported: see assessment coverage for the exact list.

A qualified clinician must review the final report. Automation does not replace clinical judgment.

← Back to the front page · How it works · Privacy policy · Request a demo