Privacy Policy

1. Introduction

CareTicks ("we," "our," "us") is committed to protecting the privacy and security of personal and protected health information. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our Services.

2. Information We Collect

2.1 Protected Health Information (PHI)

When healthcare facilities use CareTicks, we process:

• Audio recordings of clinical encounters (AI Notes)
• Clinical documentation and SOAP notes
• Patient demographics and identifiers
• Chief complaints, symptoms, diagnoses
• Medication lists and allergies
• Medical history information
• Treatment plans and orders

2.2 Facility and User Information

• Healthcare provider credentials and identifiers
• Facility account information
• User authentication data
• Usage patterns and system interactions

2.3 Technical Information

• Device information and IP addresses
• Browser type and operating system
• Application performance data
• Error logs and diagnostic information

3. How We Use Information

3.1 Primary Purposes

• Provide and deliver CareTicks Services
• Generate AI-assisted clinical documentation
• Facilitate patient intake data collection
• Integrate with customer EHR systems
• Provide technical support

3.2 Business Operations

• Maintain and improve Services
• Ensure security and prevent fraud
• Comply with legal obligations
• Respond to legal requests
• Enforce our Terms of Service

3.3 De-Identified Data

We may create de-identified data (with all PHI removed) to:

• Improve AI model performance
• Conduct research and development
• Generate aggregate usage statistics
• Enhance system capabilities

De-identification follows HIPAA standards (Safe Harbor or Expert Determination method).

4. Information Sharing

We MAY Share Information With:

5. Data Security

5.1 Technical Safeguards

• AES-256 encryption for data at rest
• TLS 1.2+ encryption for data in transit
• Multi-factor authentication
• Role-based access controls
• Regular security audits and penetration testing

5.2 Administrative Safeguards

• Workforce training on privacy and security
• Background checks for personnel with data access
• Incident response and breach notification procedures
• Regular risk assessments

5.3 Physical Safeguards

• SOC 2 Type II certified data centers
• Physical security controls
• Secure disposal of hardware

6. Patient Rights

6.1 HIPAA Rights (US)

When CareTicks holds PHI on behalf of a healthcare facility, patients should contact the healthcare facility to exercise rights including:

• Access to their information
• Request corrections or amendments
• Request restrictions on uses/disclosures
• Request confidential communications
• Receive accounting of disclosures

6.2 GDPR Rights (EEA/UK)

For individuals in the EEA, UK, or other applicable jurisdictions:

• Right to access personal data we hold about you
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten") under certain circumstances
• Right to restrict or object to processing
• Right to data portability
• Right to withdraw consent at any time
• Right to lodge a complaint with supervisory authorities

6.3 International Data Transfers

For data transfers outside your jurisdiction, we implement appropriate safeguards including:

• Standard Contractual Clauses (SCCs) approved by EU Commission
• Adequacy decisions where applicable
• Additional technical and organizational measures
• Compliance with local data residency requirements

7. Data Retention

We retain personal and health information only as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal obligations, and resolve disputes.

• Clinical data: Retained per customer contract terms and regulatory requirements
• Account information: Retained while account is active plus applicable retention periods
• De-identified data: May be retained indefinitely for research and improvement
• Backup data: Retained according to backup retention schedules (typically 90 days)

Upon request, we will securely delete or return customer data as specified in service agreements.

8. Breach Notification

In the event of a data breach affecting PHI or personal data, we will:

• Notify affected customers without unreasonable delay (within 72 hours for GDPR breaches)
• Provide details of the breach, affected data types, and mitigation measures
• Cooperate with customers in their notification obligations to individuals and authorities
• Comply with HIPAA breach notification requirements (within 60 days)
• Notify relevant supervisory authorities as required by applicable law

9. Children's Privacy

CareTicks Services are not directed to children under 13 (or applicable age in your jurisdiction). We do not knowingly collect personal information from children. When used in pediatric healthcare settings, the healthcare facility is responsible for obtaining appropriate parental/guardian consent.

10. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated to customers via email or through the Services. Continued use of the Services after changes constitutes acceptance of the updated policy.

11. Contact Us