Privacy Policy

Overview

Healthcare Agent serves two distinct groups, and the data we handle differs for each:

• Clinic customers (and their administrators) who use our platform to configure and manage the AI patient assistant
• Patients who interact with the AI assistant through the clinic's embeddable chat widget

For patient data, it is important to understand that we process patient information on behalf of the clinic. The clinic is the Covered Entity under HIPAA and determines how patient data is used. We act as a Business Associate and process patient data only as instructed by the clinic and as described in our Business Associate Agreement.

Information We Collect

From clinic customers

• Account information: Name, email address, password (stored with industry-standard hashing), organization name, role
• Configuration data: Clinic settings, policy rules, scheduling preferences, intake form configurations, EHR integration credentials (encrypted with AES-256-GCM)
• Usage data: API call logs, feature usage, admin dashboard activity, audit trail events
• Billing information: Payment details are processed by our payment processor and not stored on our servers

From patients (via the clinic's chat widget)

When a patient interacts with Healthcare Agent through a clinic's embedded chat widget, we may process the following on behalf of the clinic:

• Identity verification data: Name, date of birth, phone number or email (used for OTP verification)
• Chat messages: Conversation content between the patient and the AI assistant
• Scheduling data: Appointment requests, preferred times, provider preferences
• Insurance information: Carrier name, policy number, group number (as provided through the chat or retrieved from the EHR)
• Intake responses: Answers to intake forms configured by the clinic
• Session data: A session identifier stored in the browser to maintain the conversation state

This data constitutes protected health information (PHI) and is handled in accordance with HIPAA and our BAA. See our HIPAA Compliance page for details.

From website visitors

When you visit our marketing website (healthcareagent.com), we may collect:

• Standard analytics data: Pages visited, referring URL, browser type, device type, general geographic location (country/region level)
• Contact form submissions: Name, email, organization, and message content when you reach out to us

We do not collect PHI through our marketing website. The marketing site and the application are separate systems.

How We Use Information

To provide the Service

• Process patient interactions through the AI assistant (scheduling, insurance verification, intake)
• Connect to EHR systems on behalf of the clinic to retrieve and update patient records
• Send transactional communications (OTP codes, appointment confirmations, notifications)
• Authenticate admin users and enforce role-based access controls
• Generate analytics and reporting for clinic administrators

To improve the Service

• Monitor system performance and reliability
• Analyze aggregated, de-identified usage patterns to improve the AI assistant's accuracy and usefulness
• Identify and fix bugs, errors, and security issues

We do not use individually identifiable PHI to train AI models. Any data used for service improvement is aggregated and de-identified in accordance with HIPAA's de-identification standards (Safe Harbor method).

For analytics

• Understand how our marketing website is used
• Measure the effectiveness of our communications
• Improve our website and documentation

How We Store Information

All data is stored on HIPAA-compliant infrastructure provided by Aptible, within the United States. Our storage practices include:

• Encryption at rest: All data is encrypted using AES-256. Sensitive fields (EHR credentials, API tokens) receive additional application-layer encryption using AES-256-GCM.
• Encryption in transit: All data transmitted between clients and our servers, and between our servers and third-party services, is encrypted using TLS 1.2 or higher.
• Database security: Databases run in isolated, encrypted environments with network-level access controls. Backups are encrypted and stored securely.
• Access controls: Production data access is restricted to authorized personnel and logged. We follow the principle of least privilege.

Who We Share Information With

We do not sell, rent, or trade personal information or PHI. We share data only with the following categories of recipients:

Sub-processors

We use a limited set of sub-processors to provide the Service. Each has been evaluated for security and privacy practices, and appropriate agreements (including BAAs) will be executed prior to launch.

Sub-Processor	Purpose	Data Shared
Aptible	Infrastructure hosting	All application data (encrypted at rest and in transit)
Anthropic (Claude API)	AI language model	Conversation content for generating responses
SendGrid	Transactional email	Recipient email addresses, message content (OTP codes, notifications)

Business Associate Agreements will be executed with all sub-processors that handle PHI prior to launch.

Legal requirements

We may disclose information if required by law, regulation, legal process, or governmental request. We will notify you before disclosing your information unless prohibited by law from doing so.

Business transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change and ensure that the acquiring entity is bound by commitments consistent with this Privacy Policy.

Data Retention

• Clinic account data: Retained for the duration of the customer relationship. Upon account termination, data is available for export for 30 days, then deleted from active systems. Backups are purged within 90 days.
• Patient data: Retained in our active systems for the duration of the clinic's subscription. Clinics can request deletion of specific patient data at any time.
• Audit logs: Retained for 7 years by default to meet HIPAA requirements. This period is configurable per clinic.
• Website analytics: Retained for up to 26 months, then automatically deleted.
• Contact form submissions: Retained for as long as necessary to respond and follow up, then deleted.

Cookies and Local Storage

We use a minimal number of cookies and browser storage mechanisms:

Admin dashboard (app)

• Session cookie: A secure session cookie with industry-standard protections that maintains your authenticated session. This is strictly necessary for the Service to function and does not track you across other websites.

Patient chat widget

• Browser storage: The embeddable chat widget uses browser storage to maintain the conversation session (session ID and verification state). This data stays in the patient's browser and is not used for tracking.

Marketing website

• We may use analytics cookies on our marketing website to understand traffic patterns. These cookies do not collect PHI and are not connected to the application.

We do not use advertising cookies, tracking pixels, or third-party marketing trackers on the application or the chat widget.

Children's Privacy

Healthcare Agent is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13 through our marketing website or directly through the Service.

However, clinics that serve pediatric patients may use Healthcare Agent to process information about minors as part of their clinical operations. In such cases, the clinic (as the Covered Entity) is responsible for ensuring appropriate consent and compliance with applicable laws, including HIPAA and COPPA. We process this data solely as directed by the clinic under the BAA.

International Data

Healthcare Agent is a US-based service. All data is processed and stored in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the US.

We do not currently offer data residency options outside of the United States. If you have specific data residency requirements, please contact us to discuss your needs.

Your Rights

For clinic administrators

If you are a clinic administrator or user, you may:

• Access your account information through the admin dashboard
• Update your account information, including your name, email, and password
• Export your clinic's data, including configuration, analytics, and audit logs
• Delete your account by contacting us. We will delete your data in accordance with our retention policy and any applicable legal requirements.

To exercise these rights, contact us at privacy@healthcareagent.com.

For patients

Because we process patient data on behalf of the clinic, patients should contact their healthcare provider (the clinic) to exercise their data rights. The clinic, as the Covered Entity under HIPAA, is responsible for responding to patient data requests. We will assist clinics in fulfilling these requests as needed.

For more information about patient rights under HIPAA, see our HIPAA Compliance page.

California residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA). However, PHI that is handled in accordance with HIPAA is exempt from CCPA. For non-PHI data, California residents may contact us to request access to, deletion of, or information about the personal information we collect.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make changes:

• We will update the "Last updated" date at the top of this page
• For material changes, we will notify clinic administrators by email or through the admin dashboard at least 15 days before the changes take effect
• The previous version of the Privacy Policy will remain available upon request

Your continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy.

Contact

If you have questions or concerns about this Privacy Policy or our data practices, contact us at:

[Company Name]
Email: privacy@healthcareagent.com

For HIPAA-specific questions, contact hipaa@healthcareagent.com. For security concerns, contact security@healthcareagent.com.