Privacy by Architecture: Operating Room AI Security and Data Protection
De-identification runs on the hospital's own hardware, inside the hospital's own network: Vetro locates every person in the frame and anonymizes them through pixelation and blurring that cannot be undone. The raw data is deleted at the edge immediately afterward, with no technical means to reconstruct it, and it never leaves the hospital. What does travel is de-identified video and event data, held in a single-tenant environment in the hospital's own region, and the hospital keeps ownership of its data throughout. This page sets out how that works, what VitVio holds today, and what Vetro deliberately does not do.
Security and privacy here are properties of the architecture rather than a policy layer on top of it. A policy describes what a company intends to do with the data it holds. An architecture decides what it can do at all. Everything below is the second kind.
What the system sees
Vetro resolves the operating room into a small number of things: where people are standing, what is in their hands, which instruments are in the sterile field, and which stage of the procedure the case has reached. It works from shape and position rather than appearance. People are anonymized in the frame before anything is stored, and identity is neither an input the system uses nor an output it produces.
That has a consequence worth drawing out. A system that cannot tell one person from another cannot report on one person rather than another. De-identification is agnostic to a person's role and to what they are doing, so there is no configuration in which Vetro pays closer attention to one member of the team.
Earlier operating room technology often measured individuals, and staff learned to expect that. Vetro was built the other way round: the unit of measurement is the case, not the person in it. If the team does not experience it that way, the deployment has failed regardless of how well the technology performs.
The people who need this page are CISOs and security reviewers assessing the platform, DPOs and clinical governance leads running the DPIA, and the surgeons, nurses, and anesthesiologists who work in the room and want to know what it means for them.
How the architecture protects people
Vetro's protections sit in four places: the sensor data, what survives of it, the infrastructure it runs on, and the oversight around all of it.
- Sensor data. People are anonymized through pixelation and blurring that cannot be undone, on hardware inside the hospital's own network. The raw data is deleted immediately afterward and never leaves the hospital. What Vetro produces in real time is event data.
- The data that remains. A small amount is kept as short anonymized clips around logged events, carrying no link to a date, a team, or a patient. The rest is deleted on the hospital's agreed schedule, seven days by default. No surgical video is discoverable.
- The infrastructure. Each hospital runs in its own single-tenant environment in its own region, isolated from every other hospital. The on-site platform connects outbound only, so no inbound firewall ports are opened, and nothing serving production is reachable from the public internet.
- The access. Data is encrypted in transit and at rest. Access is role-based and controlled by the hospital, and audit logging lets the hospital's own cyber team trace who did what.
- The oversight. Compliance is monitored continuously rather than at audit time, VitVio commissions third-party penetration testing regularly, and privileged access to keys and production databases is formally reviewed.
Underneath those four sits the detail a security team will ask for: production isolated from development and test, engineering access only through a private overlay network with SSH brokered by an identity-aware proxy, intrusion detection on mirrored network traffic, encryption of ePHI in transit and at rest, secret scanning and dependency auditing in the build pipeline, and deterministic builds to limit supply-chain risk. A detailed cybersecurity packet covering all of it is provided to the hospital's CISO and governance teams at project kickoff.
The through-line is that the hospital keeps control of its own data at every stage. It is captured on the hospital's hardware, anonymized before it goes anywhere, held in the hospital's own isolated environment, and deleted on the hospital's schedule. VitVio's job is to make that data useful, not to hold on to it.
What Vetro does not do
The section above describes how Vetro works. This one describes where it stops, which is usually the more useful half of the answer.
- It does not evaluate individuals. Vetro does not score staff performance, does not track breaks or personal behavior, and does not feed anything into HR processes. It measures the process, not the people running it.
- It does not send identifiable video anywhere. Nothing identifiable leaves the hospital, because nothing identifiable survives de-identification.
- It does not make clinical decisions. Vetro does not replace established safety protocols, including surgical counts and checklists.
- It does not file documentation on its own. Nothing reaches the patient record without clinician review and sign-off.
None of this is a compliance exercise. Vetro exists to take work off your plate, and that is the test every capability has to pass: does it make your day easier. You will not see VitVio ship something that adds pressure to the people doing the work. That is the ethos behind the whole platform, not just the parts described on this page.
Certifications and compliance
Security reviews turn on the difference between certified and compliant, so the two are kept separate below, and nothing appears on either list that has not been earned.
- Independently attested today: SOC 2 Type 2 and Cyber Essentials Plus.
- Assessed as compliant: HIPAA, GDPR, NHS DSPT, DTAC, and DCB0129.
Each of these was issued or reviewed by an accredited third-party auditor, and compliance is verified continuously through Vanta rather than checked once a year. VitVio also commissions third-party penetration testing on a regular cycle.
The hospital owns its data, and retention is the hospital's decision.
Security documentation, including framework evidence and completed questionnaires, is available through VitVio's Trust Center on request.
Frequently asked questions
Is raw video stored?
No. The raw data is deleted at the edge immediately after de-identification, with no technical means to reconstruct it, and it never leaves the hospital.
Does any data leave the hospital?
Nothing identifiable does. De-identified video and event data are held in a single-tenant environment in the hospital's own region, isolated from every other hospital. The raw data stays on site and is deleted there.
How long is anything kept?
Retention is the hospital's decision, seven days by default, and most footage is deleted within hours of capture. A small amount is kept as short anonymized clips around logged events to improve the models, carrying no link to a date, a team, or a patient. No surgical video is discoverable.
Who can access the data?
Access is role-based and controlled by the hospital, and every action and edit is recorded in an audit trail the hospital's own cyber team can inspect. On VitVio's side, nothing serving production is reachable from the public internet and privileged access is formally reviewed.
Can Vetro integrate with our single sign-on?
Yes. Identity and access management run through a managed identity provider, so Vetro federates with the hospital's own SSO and inherits its authentication policies, including MFA. Roles travel in the token, which means access levels stay governed by the hospital's own directory rather than a separate user list VitVio maintains. Access ends when the hospital's directory says it ends.
Does Vetro record audio?
Not by default. Some hospitals choose to enable a wake word to help pre-draft operative notes, and Vetro's core function does not depend on audio.
Is consent required?
That is the hospital's decision, and it should be made by the hospital's own legal and governance teams rather than taken from a vendor page. What VitVio can describe is where Vetro sits. Its purpose is operational: it supports the running of the hospital rather than clinical decision-making or research, and no identifiable video is retained, stored, or transmitted. In most jurisdictions that combination falls within the permissions hospitals already rely on to run their operations, so a separate consent process is generally not required.
Some hospitals choose to add one anyway, and that is a reasonable position. Where they do, our recommendation is to fold Vetro into the hospital's existing consent policy rather than creating a standalone consent for it. A separate form invites the question of why this one thing needs its own permission, and the answer is that it does not.
If our hospital runs an active consent process, can Vetro be turned off?
Yes, and it can be automatic. Vetro can ingest the hospital's e-consent data and disable itself for any case where consent has not been given, with no action required from anyone in the room. Automatic detection can also be switched off manually, in any operating room.
When it is off, Vetro's interfaces still work. The team uses them exactly as before, entering case events themselves rather than having them detected, so no part of the room's workflow depends on capture being on.
If something is captured that should not have been, the hospital can delete it themselves. That control sits with the hospital rather than requiring a request to VitVio.
Can staff raise concerns?
Yes, through the hospital's own governance process, which is the right route because these are the hospital's decisions to make. Every deployment also includes a workshop where the team can put these questions directly to VitVio.
Will VitVio support our DPIA and security review?
Yes. Framework evidence and completed security questionnaires are available through the Trust Center, and VitVio's team works directly with security, privacy, and governance reviewers through deployment. A detailed cybersecurity packet is also provided to the CISO and governance teams at project kickoff.
Talk to us about governance
Bring your CISO and DPO. Book a 30-minute session and walk through the architecture and controls. Book a demo
Related: Vetro product page · EHR integrations · Perioperative workflow automation
