Federal LLM Disclosure

October Health publishes an AI Usage Policy covering how artificial intelligence is used across our products and services, including permitted and prohibited uses, data handling, user rights, and our commitment to safe and ethical AI. The policy applies to all LLM-backed features and is binding on October Health and its users.

October Health does not train foundation models. The models we deploy are developed, trained, and documented by their providers, each of whom publishes system cards and benchmark evaluations covering training process, identified risks and mitigations, and model evaluation scores on standard LLM benchmarks. Provider-published documentation therefore constitutes the training-process and benchmark record for the underlying models.

The models in production, their purposes, data-processing terms, retention periods, and risk classifications are maintained in our public AI Model Register, reviewed quarterly. October Health's own evaluation record — the system-level testing of our deployed configurations — is published in full at AI Transparency Testing and summarised below.

The following artifact sets are maintained internally under version control and are provided to contracting agencies on request under NDA:

• Architecture decision records: a versioned ADR log covering model selection, safeguard design, and infrastructure decisions for each LLM-backed system.
• API documentation and specifications: OpenAPI specifications for the platform APIs through which LLM features are exposed, including authentication, rate limiting, and audit logging.
• Data lineage and dataset descriptions: documentation of data flows covering conversation data, assessment data, and derived signals — from ingestion through the safeguard layer, provider processing terms, and retention and deletion schedules.

Requests are handled by our AI Governance & Data Protection Officer at dpo@october.health.

Development artifacts for LLM-backed systems — contextual documentation, project blueprints, prompt and configuration templates, and engineering boilerplates — are maintained internally alongside the codebase. All system prompts are version-controlled and peer-reviewed before deployment. These artifacts are provided to contracting agencies on request under NDA.

October Health operates a published AI Governance Policy aligned with the EU AI Act (Regulation (EU) 2024/1689) and ISO/IEC 42001:2023, covering risk classification, lifecycle governance, human oversight, incident response, and third-party provider management.

• Risk assessments: every AI system is risk-classified before deployment, signed off by the Data Protection Officer and CTO. A Data Protection Impact Assessment is conducted for all High-Risk systems.
• Audit cadence: monthly automated metric review, quarterly internal audit, and an annual full external safety audit. Findings are logged in the AI Governance Register and tracked to closure.
• Security posture: October Health is SOC 2 Type II certified and undergoes annual third-party penetration testing; reports are available via our Trust Center.
• Evaluation and test results: published in full at AI Transparency Testing.

Product requirements documents, traceability reports, and internal security checklists are provided on request under NDA.

Every LLM-backed surface in October Health is designed around the principle that AI assists people and never silently replaces them:

• Disclosure by design: users are always informed when they are interacting with AI. All conversational agents are clearly identified as AI, in line with the EU AI Act Article 52 transparency obligation.
• Human escape hatch: a phone button is available at any time in every AI conversation, letting the user contact a human directly. The agents are instructed to reference it whenever a conversation would be better served by a person.
• Crisis break-out: when high-risk signals are detected, the conversation is immediately broken and the user is presented with emergency contact details and crisis resources — with no intermediate step.
• Advisory-only consequential outputs: hiring-support outputs are advisory, accompanied by explanations and confidence indicators. Final decisions are always made by humans.
• Administrator control: organisation administrators can disable or limit AI features on a per-organisation basis.
• Explainability: users can ask agents to explain the reasoning behind their responses, and AI-generated recommendations are presented with context about their nature and limitations.

The deployed models reside in their providers' cloud infrastructure and are accessed exclusively through encrypted inference APIs from the October Health platform, hosted on AWS in us-east-1 (US East, N. Virginia). All October Health hosting is US-based. No model weights are transferred to or hosted by October Health.

• Inputs: user input passes an inbound safeguard layer — moderation gate, crisis-detection break-out, and PII minimisation — before any model call is made.
• Outputs: model output passes an outbound safeguard layer — post-response moderation and human-in-the-loop review for hiring and crisis contexts — before reaching the user.
• Connections: the production deployment connects only to the providers registered in the AI Model Register, under contractual no-training terms, Data Processing Agreements, and Standard Contractual Clauses.
• Isolation: production is isolated from any other model versions or experimental iterations — separate environments with no shared state. Provider-side retention is zero across all registered providers.

Detailed architectural and data-flow diagrams beyond this overview are provided to contracting agencies on request under NDA.

• Help center: searchable product documentation at support.october.health, covering every AI feature, including what each agent does, its limitations, and how to use it well.
• In-product guidance: AI surfaces are automatically guided in-app — first-run onboarding for each agent, with clear statements of what the AI can and cannot help with.
• Administrator and developer guides: configuration guides for organisation administrators — including AI feature controls and retention settings — and API documentation for integration teams.
• Deployment support: contracting agencies receive structured onboarding, training sessions, and named support contacts as part of rollout.

• Per-response feedback: every AI response can be rated in-app (positive/negative with optional comment). Feedback is reviewed as part of the monthly automated metric cycle and feeds escalation-rate monitoring.
• In-app support: a support channel is available inside the product; the phone button connects users to a human at any point in an AI conversation.
• Administrator escalation: organisation administrators have a named escalation path for AI-related concerns affecting their workforce.
• Incident reporting: AI incidents are reported to security@october.health and handled within 24 hours of detection; personal data breaches are notified to the supervisory authority within 72 hours under GDPR Article 33.
• Governance queries: dpo@october.health for questions about this disclosure, our model register, or transparency testing.

Demographic fairness. October Health pre-registers and publishes bias testing across protected characteristics — gender, age, race/ethnicity, disability, and pregnancy/maternity — with a maximum 5% disparity threshold across demographic groups. Flip testing of our hiring-support AI showed 100% recommendation consistency across 400 demographic pairs; prompt bias testing across our conversational agents flagged 0 of 959 cases. Full methodology and results are published at AI Transparency Testing, and escalation rates are monitored monthly with automated alerts on any disparity above 5%.

Truth-seeking and ideological neutrality. October Health's agents are scoped to workplace wellbeing, coaching, and nutrition. System prompts constrain agents to their domain and to decline requests for political or ideological advocacy; responses are grounded in the user's own context rather than editorial positions. The underlying foundation models are provided by vendors that publish model specifications and behaviour policies and maintain US-government offerings. October Health's system-prompt and safeguard configurations are available for agency review on request under NDA, so compliance with the Unbiased AI Principles can be assessed directly against the deployed configuration.