Every patient could arrive already briefed.
Cellar gives your patients one home for every lab, scan, wearable data, and visit note. When they share, you open a single link and their history is in front of you. No portal, no account, nothing for your practice to run.
Yours alone to recommend
Your patient owns the records and shares them under their own right of access (HIPAA and GDPR). Cellar is not a HIPAA-covered entity and not your business associate, so there is no compliance review and no BAA; recommending it is yours alone to decide.
- Not your business associate: no BAA to sign, no patient data to store
- Encrypted, read-only, revocable, processed in your patient's region
- Your call alone: no IT, procurement, or privacy-office sign-off
Compliance
You can recommend Cellar on your own. Here is why.
Cellar is a personal health record, held and controlled by your patient. Receiving a link is the patient handing you their own records, like the folder they would bring to a visit, only legible and source-linked. The review a hospital runs before buying a vendor does not apply here, because a patient sharing their own records runs on their right of access, which keeps the obligations off your practice.
A personal health record
Cellar is patient-held and patient-controlled, like the records a patient keeps themselves. It is not an EHR or a portal, and it does not connect to your systems.
The patient's right of access
Under HIPAA and GDPR, patients have the right to obtain and share copies of their own records. A patient sending you a Cellar link is exercising that right, on their own initiative.
Nothing for you to approve
Because the patient chose Cellar and directs the data, Cellar is not your business associate: no BAA to sign, and no patient data for your practice to store. There is no vendor for IT, procurement, or your privacy office to review, because nothing connects to your systems.
Bottom line: this is a decision you can make on your own. Telling a patient about Cellar, or opening a link they send, is a clinical judgment, not a procurement decision.
For patients in the EU, records are processed in their assigned region under no-training terms, and patients can export everything or delete it permanently anytime. This explains how patient-directed records work and is not legal advice; see our terms for the full picture.
The reconstruction tax
Care begins with reconstruction.
Before the clinical question, there is the archaeology. The history exists. It just isn't legible yet, so the start of a visit goes to assembling a picture instead of reading one.
A folder of PDFs
Scans and exports in no order, some legible, some photographed at an angle.
Half-remembered values
A number, a date, and a unit, all approximate.
Portals that don't talk
One login per health system, none sharing a timeline with the others.
Another hospital or country
Records from a prior city, system, or language that never reach your desk.
The cost is real: blind spots, repeated tests, and minutes spent rebuilding a history the patient already lived. Cellar moves that work before the visit, where the patient can do it once.
What you receive
A handoff, built by the patient.
Your patient assembles it in Cellar from their own records and the vitals they sync from a wearable. You open a clean, read-only summary: structured, source-grounded, and current. This is a real example.
Prepared
Jun 4, 2026
Patient
Marcus Avery
Male · 45 yrs · Records Nov 12, 2024 to Jun 3, 2026
Assembled for a cardiology consult visit
Clinical snapshot
As reported in the patient's records. Dates show when each was last recorded, not that it is current.
Allergies
- Penicillin · hives
- Iodinated contrast · flushing, hives (2019 CT)
Medications
- Rosuvastatin · 10 mg · daily, replaced atorvastatin (myalgia)
- Ezetimibe · 10 mg · daily, added Dec 2025
- Lisinopril · 10 mg · daily
Conditions
- Hyperlipidemia · on therapy since 2024
- Prediabetes · A1c 5.7%, diet-managed
- Hypertension · controlled
Illustrative example built from the real product. The patient and values are fictional.
- 1
A clinician handoff header
Who shared it, DOB and age, when it was prepared, when access expires, and how many sources it draws on.
- 2
Values grounded to the source
Every value cites the exact document, date, and page, with the original quote one click away and the original file included.
- 3
Trends, labs and wearables together
Repeat lab measures are normalized across labs and units and charted against the reference range. Vitals the patient syncs from a wearable, like resting heart rate and HRV, trend on the same view, so a direction is visible at a glance.
- 4
Honest flags, not a clean fiction
Low-confidence or conflicting values are marked unconfirmed. When a packet is built for a specialty, gaps are stated rather than guessed.
- 5
Read-only and revocable
The link does not allow edits, can carry an expiry, and the patient can revoke it anytime. Nothing about your systems is touched.
Verifiable, not asserted
Patient-provided. Not patient-asserted.
This is not a patient retyping numbers from memory. Cellar reads the patient's own original documents and grounds every value to the page and text it came from. You can verify in one click.
Trace any value to its page
Each fact carries its document, date, page, and the exact quote it was read from.
The original is always kept
Originals are included in the packet, so you can open the source document, not just a restatement.
Uncertainty is shown, not hidden
Anything low-confidence or conflicting is flagged unconfirmed, never folded in silently.
Zero adoption
Nothing to install. Nothing to integrate.
Receiving a Cellar packet costs your practice no setup, no training, and no maintenance.
Not an EHR
Cellar doesn't replace or connect to your systems. It rides alongside them, held by the patient.
No account for you
You open a link in any browser. There is nothing to provision, learn, or sign in to.
No data burden
The records are the patient's, shared by the patient, and revocable by the patient. You receive a read-only copy.
Security, stated plainly
Built to the standard hospitals require.
We describe our security plainly and only claim what is true. Here is the part that matters for the data your patients share with you.
Encrypted at rest and in transit
Envelope encryption per record, wrapped to a per-account key and a key-management service. Everything moves over TLS.
Never trained on
To read a document, Cellar decrypts it transiently in the patient's assigned region and sends it to a third-party AI model under no-training terms.
Honest about access
We call this compliant processing, not an architecture where the operator is technically incapable of access. We only claim what is true, and our roadmap moves processing into a confidential-computing enclave.
Patient-controlled
Revoke anytime, set an expiry on the link, export everything in one step, and delete permanently. Deletion destroys the account key.
Access trail
Share links are validated by a hashed token and show the owner when they have been opened. Every record query is scoped to its own account.
No analytics or tracking
No third-party analytics, advertising pixels, session recording, or trackers. Diagnostic error reports are scrubbed of record content and identifiers.
For practices and hospitals
Referrals and second opinions that arrive complete.
The benefit compounds across a panel. When patients keep their history in Cellar, the people you see arrive legible, whatever system or country they came from.
Complete referrals
New and referred patients arrive with history already organized and verifiable, so the first visit starts on the clinical question.
Any specialty
Patients can build a visit-specific packet for a given specialty, surfacing the relevant records and stating what is missing.
Any language, original kept
Records in other languages are read and the original is preserved. The packet is presented in the patient's chosen language.
What to tell patients
One sentence to a patient. Better visits after.
Telling a patient is light: one sentence, not a vendor you take on. Pointing them to a tool they own is not choosing a system for your practice, and the payoff arrives at the next visit, and every one after it.
Before a visit
Ask them to bring their history
Suggest new and returning patients keep their records in Cellar and bring a link ahead of the appointment.
In your summary
Add one line to the after-visit note
A ready sentence patients can act on, so the record they build follows them to the next clinician too.
For complex patients
Suggest a visit-specific packet
For referrals or second opinions, point patients to build a packet for the specialty they are seeing.
Keep your records in Cellar and bring a link to our next visit: carecellar.com
Free for you to receive. Patients start with a 14-day trial, then $200 a year.
Questions clinicians ask
Straight answers.
Is this an electronic health record?+
No. Cellar is a personal, patient-held vault. It does not replace or connect to your EHR. The patient organizes their own records and shares a read-only summary with you.
Do I need an account or a login?+
No. You open the patient's link in any browser. There is nothing to install, provision, or sign in to.
Does recommending it create HIPAA obligations or need a BAA?+
HIPAA applies to providers, insurers, and their vendors, not to a personal health record the patient holds and controls. Cellar is not a covered entity and not your business associate, so there is no BAA to sign. A patient sharing their records is exercising their own right of access. This describes how patient-directed records work, and is not legal advice.
I'm employed by a hospital or health system. Do I need its approval to suggest Cellar or open a patient's link?+
No. Your institution is not adopting, integrating, or contracting anything, nothing connects to its systems, and it stores no data. Suggesting a tool to your patient, and reading records they chose to share, is a clinical judgment, not a procurement decision. This describes how patient-directed records work, is not legal advice, and does not replace any policy your employer sets.
A patient sent me a Cellar link I was not expecting. Is it safe to open?+
Yes. It opens read-only in any browser, with nothing to install or sign into. These are the patient's own records, shared and revocable by them. Open it as you would a PDF they emailed, except every value traces to its source page.
Can I trust data a patient assembled?+
It is read from the patient's own documents, not typed from memory, and every value is grounded to the exact page and quote. Originals are included, and low-confidence values are flagged unconfirmed. You can verify any value in one click.
Is it secure and private?+
Records are encrypted at rest and in transit, are never used to train models, and are processed by a third-party AI model in the patient's assigned region under no-training terms. We describe the model honestly rather than overstating it.
What does it cost me or my patients?+
Nothing for you to receive a packet. Patients start with a 14-day trial, then $200 a year.
Can a patient revoke access after sharing?+
Yes, anytime. Links are read-only, can carry an expiry, and the patient can turn off access whenever they choose.
What about records in other languages or countries?+
Cellar reads records in any language and always keeps the original. A clinician packet can be generated in a chosen language.
Can I trust vitals from a patient's wearable?+
Wearable vitals are imported deterministically, not read by a model: each metric maps to a known type and is aggregated to one value per day. You see resting heart rate, HRV, sleep, and weight between visits, labeled as device-measured and shown as trends, never as a diagnosis. The import is read-only, so Cellar never writes back to the device.