Client Agent / App / APEX MCP · GraphQL · REST PII enters boringai Gateway regex · 14 categories HL7 v2 field-aware profile · HIPAA / GDPR billing · 2 cr de-identified LLM Provider z.ai GLM / OpenAI never sees PHI PII enters from the left — de-identified text exits to the right. The provider never becomes a Business Associate under HIPAA. ONE REQUEST, TRACED