Privacy Policy

• Account: email, name (Google sign-in)
• Application info: country, license number, clinic name/address, contact, referrer, bio
• Clinical data — entered by the practitioner; includes SOAP notes, acupoint prescriptions, and patient identifiers:
  • Patient code (practitioner-chosen identifier)
  • Patient name (optional, entered by practitioner) — PHI
  • Clinical narrative (symptoms, treatment plan, etc.)

All clinical data is stored on HIPAA BAA-covered infrastructure (Microsoft Azure, US West region). Access to clinical records is recorded in an audit log.

Clinical narrative is sent to the Anthropic Claude API for SOAP generation. AI requests do not include patient identifying information (PHI):

• Dates are replaced with [date] placeholders
• Patient names and patient codes are not included in AI requests
• If a practitioner enters patient identifying information into free-text fields, that text will be sent to AI (this is the practitioner's responsibility — see Terms §2)

Anthropic provides its API under a HIPAA Business Associate Agreement. Data sent to the API is not used to train models.