Health questions run under a stricter policy — before a single record is read

A resident asking a municipal system when their permit is ready and a patient asking a clinic when their next appointment is are, on the surface, the same kind of question — a lookup, answered from a system of record. They are not the same kind of risk, and treating them identically is exactly the mistake a health-adjacent module can't afford to make.

Floored, not flagged

Health-adjacent modules on this platform are set to the strictest sensitivity class before a single record is ever read — not flagged as sensitive after the fact by someone reviewing the module, and not something a module author has to remember to configure correctly. The floor is the starting point, and nothing lowers it.

What that actually restricts

Under that class, a health-adjacent conversation is never sampled into analytics, and no summary is written if the conversation reaches a person — the two most common ways sensitive content quietly leaks into places it was never meant to go. A clinic asked "when is my next appointment?" answers with the appointment, the doctor and the location, sourced from the scheduling system, and identity is verified before any of it is shown.

Why this can't be a retrofit

A platform that adds this protection after a health module is already live is a platform that was exposed for however long the gap existed. Making the sensitivity floor structural — decided once, for the whole class of module, before the first one ships — is what keeps a healthcare customer's audit from turning up an exception.

Live the moment the channel is

This scenario runs on WhatsApp, illustrated here rather than captured, because it goes live for a given clinic the moment that business's WhatsApp account clears Meta's own approval — a step outside this platform's control, and one the honest version of this page says plainly rather than pretending is already done.