Data & Privacy Policy
Effective Date: March 17, 2026 | Last Updated: August 23, 2026 | Version: 2026.08.23
This Data & Privacy Policy ("Policy") describes how Provider Plexus, Inc. ("Provider Plexus," "Company," "we," "us," or "our") collects, uses, discloses, stores, and protects information when you use our products, services, applications, and platforms (collectively, the "Services"). This includes the Provider Plexus web application, browser extension, mobile application, telehealth patient portal, audio streaming and transcription services, and all associated APIs.
We understand that the data you entrust to us includes sensitive health information. We take this responsibility seriously and are committed to protecting your privacy in compliance with the Health Insurance Portability and Accountability Act ("HIPAA"), applicable state privacy laws, and industry best practices.
1. Information We Collect
1.1 Information You Provide Directly
- Account Information: Name, email address, professional credentials, organizational affiliation, role, and login credentials when you create an account.
- Patient Demographics: Full name, date of birth, Social Security Number, phone number, mailing address, email address, driver's license number, and emergency contact information collected through the telehealth intake portal.
- Insurance Information: Payer name, member ID, group number, plan type, subscriber details, and policy information.
- Clinical Documentation: Medical notes, clinical encounter documentation, procedure details, and diagnostic information uploaded or entered into the Services.
- Audio Recordings: Voice recordings of clinical encounters captured through the ambient documentation features (browser extension and web application) with patient consent.
- Medical Imaging: DICOM files and other medical imaging uploaded through the Services.
- Medical History: Patient-reported medical history, medications, allergies, surgical history, and family medical history.
- Consent Records: Digital signatures and consent form completions for HIPAA authorization and telehealth consent.
- Payment Information: Credit or debit card information provided for payment processing (collected and stored exclusively by Stripe, Inc.; Provider Plexus does not store card numbers).
- Communications: Inquiries, support requests, and feedback submitted through the help form or email.
1.2 Information Collected Automatically
- Device and Browser Information: IP address, browser type and version, operating system, device type, screen resolution, and language preferences.
- Usage Data: Pages visited, features used, click patterns, session duration, timestamps, referral URLs, and navigation paths within the Services.
- Performance Data: Page load times, error logs, API response times, and service performance metrics.
- Authentication Events: Login timestamps, login methods (password, SSO, 2FA), failed login attempts, and session activity.
- Cookies and Similar Technologies: Session cookies for authentication and security across all Services. Third-party fraud-prevention cookies set by Stripe during payment collection on the patient telehealth portal. Analytics cookies are used only on the provider-facing web application; the patient telehealth portal at providerplexus.com and the mobile application do not use analytics cookies (see Section 8).
1.3 Information Collected Through the Mobile Application
When you use the Provider Plexus mobile application (iOS), the following additional information may be collected:
- Device Identifiers: A unique device identifier (UUID) generated on first launch, used for authentication token management and push notification delivery. This identifier is not linked to hardware identifiers or advertising IDs.
- Device Information: Device operating system and version (e.g., "iOS 17.4"), used for session management and security logging.
- Biometric Authentication: The mobile app supports Face ID for secure login. Biometric data is processed entirely on-device by Apple's Local Authentication framework. Provider Plexus never receives, transmits, or stores your biometric data. Only a boolean preference indicating whether Face ID is enabled is stored.
- Push Notification Tokens: Firebase Cloud Messaging (FCM) tokens are collected to deliver push notifications for incoming consult requests and visit updates. FCM tokens are transmitted to Google's Firebase service solely for notification delivery.
- Profile Pictures: If you upload a profile picture, the image is compressed on-device and transmitted to our servers via HTTPS.
- Authentication Events: Login, logout, and biometric login events are logged with timestamps for security and audit purposes.
- Calendar Integration: If you connect a third-party calendar (Google, Outlook, or Apple Calendar) for schedule management, OAuth authorization codes are exchanged with the respective provider through our backend. Calendar data is used solely for availability management.
- Product Analytics: Production releases send a limited set of product-usage events to Mixpanel: app opened, successful login and logout, and home-tab views. Event properties are restricted to platform, categorical account role, whether biometric login is enabled, audience type, and a controlled tab name. Mixpanel assigns an anonymous SDK identifier and may receive standard app/device metadata. Automatic event collection and IP-based geolocation are disabled. No patient or user identifiers, contact information, clinical data, messages, free text, files, or audio/video content are sent.
What the Mobile App Does Not Collect:
- No location data or GPS coordinates
- No contacts or address book data
- No advertising identifiers (IDFA) or cross-app tracking
- No browsing or search history
On-Device Security: All credentials and sensitive data stored locally on the device are encrypted using platform-provided secure storage (iOS Keychain). The app performs device integrity checks (jailbreak detection) locally; no device security data is transmitted to our servers. All API communication uses HTTPS with certificate pinning to prevent man-in-the-middle attacks.
1.4 Information from Third-Party Sources
- Electronic Health Records (EHR): Medical records, clinical data, lab results, and care summaries retrieved from EHR systems through authorized FHIR-based integrations and medical records services, with patient consent.
- Insurance Eligibility: Coverage status and benefit details obtained through eligibility verification services.
- NPI Registry: Provider information obtained from the National Provider Identifier registry for provider lookup features.
- SSO Providers: Authentication attributes provided by SAML or OIDC identity providers during single sign-on.
2. How We Use Information
2.1 Providing and Operating the Services
- Processing clinical documentation for medical code extraction (CPT, ICD-10, HCPCS) and E/M level analysis.
- Transcribing audio recordings and generating ambient clinical notes.
- Facilitating patient intake, insurance verification, and telehealth workflows.
- Processing payments and managing subscriptions.
- Retrieving and integrating medical records from connected EHR systems.
- Managing prior authorization requests and eligibility checks.
2.2 Security and Compliance
- Authenticating users, managing sessions, and enforcing access controls.
- Detecting, preventing, and responding to fraud, abuse, and security threats.
- Maintaining audit trails as required by HIPAA and other regulations.
- Monitoring for unauthorized access or PHI breaches.
2.3 Improvement and Analytics
- Analyzing usage patterns to improve the Services, user experience, and AI model performance.
- Generating aggregate, de-identified analytics and benchmarks.
- Conducting internal research and product development.
2.4 Communications
- Sending service-related notifications (account activity, security alerts, system updates).
- Responding to support requests and inquiries.
- Providing information about new features or service changes (you may opt out of non-essential communications).
2.5 Legal Compliance
- Complying with applicable laws, regulations, legal processes, or governmental requests.
- Enforcing our Terms of Service and other agreements.
- Protecting the rights, property, and safety of Provider Plexus, our users, and the public.
2.6 Google Workspace API Data and Limited Use
Provider Plexus's use of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Provider Plexus does not use Google Workspace API user data to create, train, or improve generalized or foundational artificial intelligence or machine learning models. We use this data only to provide or improve user-facing features requested by the user.
3. Protected Health Information (PHI)
3.1 HIPAA Compliance
When Provider Plexus processes PHI on behalf of a Covered Entity, we do so as a Business Associate under HIPAA. Our handling of PHI is governed by the applicable Business Associate Agreement (BAA) and the HIPAA Privacy, Security, and Breach Notification Rules.
3.2 Minimum Necessary Standard
We apply the HIPAA minimum necessary standard, accessing and processing only the minimum amount of PHI required to fulfill the specific purpose for which it was provided.
3.3 PHI Safeguards
PHI is subject to enhanced protections, including:
- Encryption at Rest: PHI is encrypted using AES-256 encryption via Google Cloud KMS with envelope encryption. Data Encryption Keys (DEKs) are managed with automated rotation and secure caching.
- Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
- Field-Level Encryption: Sensitive fields (names, phone numbers, addresses, emails, SSN) are individually encrypted in the database using dedicated encrypted column types.
- PHI Redaction in Logs: Application logs are automatically filtered to prevent PHI from appearing in system logs, error reports, or debugging output.
- Access Controls: Role-based access controls, multi-tenant data isolation, and the principle of least privilege are enforced at the application, database, and infrastructure levels.
- Audit Logging: Comprehensive audit trails record access to and actions on PHI, including user identity, timestamp, and action type.
3.4 Breach Notification
In the event of a breach of unsecured PHI, Provider Plexus will notify the affected Covered Entity without unreasonable delay and no later than as required under HIPAA (currently 60 calendar days from discovery). We will cooperate with the Covered Entity in fulfilling its breach notification obligations to affected individuals and the U.S. Department of Health and Human Services (HHS).
4. Data Sharing and Disclosure
4.1 We Do Not Sell Your Data
Provider Plexus does not sell, rent, or trade your personal information or PHI to third parties for marketing, advertising, or any other commercial purpose.
4.2 Service Providers and Subcontractors
We share data with third-party service providers who assist in delivering the Services, subject to appropriate contractual and security safeguards:
- AI Processing: OpenAI, Azure OpenAI, and Google Cloud AI Platform process clinical text for code extraction, transcription, and note generation. These providers are bound by data processing agreements and, where processing PHI, by BAAs.
- Payment Processing: Stripe, Inc. processes payment transactions. Stripe is PCI DSS Level 1 certified. Provider Plexus does not receive or store your full card number.
- Cloud Infrastructure: Google Cloud Platform provides hosting, storage, computing, and key management services under a BAA.
- Medical Records: Third-party services facilitate EHR data retrieval under BAAs and FHIR interoperability standards.
- Video Conferencing: Daily.co provides the real-time video infrastructure for telehealth visits. During a video call, audio and video streams are transmitted through Daily.co's servers. Daily.co does not have access to patient medical records or PHI beyond what is communicated during the live video session.
- Push Notifications: Google Firebase Cloud Messaging (FCM) delivers push notifications to the mobile application. FCM receives device tokens and notification metadata; no PHI is included in push notification payloads.
- Analytics: Mixpanel receives limited product analytics from the provider-facing web application, the telehealth
/beginjourney, and production releases of the Provider Plexus mobile application. Mobile events are limited to app opened, successful login and logout, and controlled home-tab views, with platform, categorical role, biometric-preference status, audience type, and tab name. Automatic mobile event collection and IP-based geolocation are disabled. No PHI, patient or user identifiers, contact information, clinical free text, medical history, imaging files, messages, or chat/video/audio content is transmitted to Mixpanel. - Error Telemetry: Runtime error reports are processed within Provider Plexus's Google Cloud environment to diagnose technical issues. Error fields are bounded and scrubbed before storage; no third-party error-monitoring service receives these reports.
4.3 Legal Requirements
We may disclose information when we believe in good faith that disclosure is necessary to:
- Comply with applicable law, regulation, legal process, or enforceable governmental request.
- Enforce our Terms of Service or investigate potential violations.
- Detect, prevent, or address fraud, security, or technical issues.
- Protect the rights, property, or safety of Provider Plexus, our users, patients, or the public.
4.4 Business Transfers
In the event of a merger, acquisition, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of the transaction. We will notify you of any such change and any choices you may have regarding your information.
4.5 With Your Consent
We may share information with third parties when you have given us explicit consent to do so.
5. Data Retention
5.1 Retention Periods
We retain information for as long as necessary to fulfill the purposes described in this Policy, comply with our legal obligations, and enforce our agreements:
- Account Information: Retained for the duration of your account and for a reasonable period thereafter for legal and operational purposes.
- Clinical Content and PHI: Retained in accordance with the applicable BAA and HIPAA requirements. Medical records are typically retained for a minimum of six (6) years from the date of creation or last effective date, or longer as required by applicable state law.
- Audio Recordings: Retained for the period specified in your subscription agreement or BAA. You may request earlier deletion subject to legal retention requirements.
- Usage and Analytics Data: Retained in de-identified or aggregated form for product improvement, reliability monitoring, funnel measurement, and abuse prevention purposes.
- Consent Records: Retained for the period required by applicable law to demonstrate valid consent.
- Security and Audit Logs: Retained for a minimum of six (6) years as required by HIPAA.
5.2 Deletion
When data is no longer needed, it is securely deleted or de-identified using industry-standard methods. In addition, when a customer organization's account is terminated, we destroy that organization's dedicated data-encryption key, which renders all of that organization's remaining encrypted data unrecoverable. This cryptographic key destruction operates at the level of a customer organization and is not available for the deletion of an individual person's records; individual deletion requests are fulfilled by secure deletion of the underlying records. Because encrypted backups are retained for disaster-recovery purposes, key destruction becomes fully effective once the applicable backup-retention period has elapsed. Records we are required by law to retain, including security and audit logs and records of disclosures retained for six (6) years under HIPAA, are preserved independently of this process before key destruction and are not affected by it.
6. Your Rights and Choices
6.1 Access and Portability
You have the right to request access to the personal information we hold about you. Where technically feasible, we will provide your data in a structured, commonly used, machine-readable format.
6.2 Correction
You have the right to request correction of inaccurate or incomplete personal information. For PHI, amendment requests will be handled in accordance with HIPAA requirements.
6.3 Deletion
You may request deletion of your personal information, subject to our legal obligations to retain certain data (e.g., medical records retention requirements, audit logs, and legal holds).
6.4 Restriction of Processing
You may request that we restrict certain processing of your personal information in specific circumstances as permitted by applicable law.
6.5 Opt-Out of Communications
You may opt out of non-essential communications by following the unsubscribe instructions in our emails or by contacting us. You cannot opt out of essential service-related communications (e.g., security alerts, account notifications).
6.6 HIPAA Rights
If your information constitutes PHI, you may have additional rights under HIPAA, including the right to:
- Request an accounting of disclosures of your PHI.
- Request restrictions on certain uses and disclosures.
- Receive confidential communications through alternative means or at alternative locations.
- File a complaint with the HHS Office for Civil Rights if you believe your privacy rights have been violated.
To exercise these rights, please note that for PHI, requests should generally be directed to the healthcare provider (Covered Entity) who collected the information. The Covered Entity will coordinate with Provider Plexus as needed.
6.7 Exercising Your Rights
To exercise any of these rights, contact us at privacy@providerplexus.com. We will respond to verifiable requests within the timeframes required by applicable law (typically 30 days, with extensions available for complex requests).
7. Data Security
7.1 Technical Safeguards
- Encryption: AES-256 encryption at rest via Google Cloud KMS with envelope encryption; TLS 1.2+ for data in transit.
- Authentication: Secure password hashing, two-factor authentication (TOTP), SAML SSO, OAuth2/OIDC support, and biometric authentication (Face ID) on mobile devices.
- Session Security: Server-side session management, configurable inactivity timeouts (HIPAA-compliant), CSRF protection, and secure cookie policies.
- Rate Limiting: Authentication endpoints are rate-limited to prevent brute-force attacks.
- Account Lockout: Automatic account lockout after repeated failed login attempts.
- Content Security Policy: Strict CSP headers to prevent cross-site scripting and data injection attacks.
- Certificate Pinning: The mobile application uses public key pinning for all API communication, preventing man-in-the-middle attacks even if a device's certificate store is compromised.
- Device Integrity: The mobile application performs jailbreak and root detection checks to ensure it is running in a secure environment.
7.2 Administrative Safeguards
- Employee access to PHI is limited on a need-to-know basis.
- All personnel with access to PHI receive HIPAA training.
- Incident response procedures are in place for security events and potential breaches.
- Regular risk assessments are conducted as required by the HIPAA Security Rule.
7.3 Physical Safeguards
- The Services are hosted on Google Cloud Platform, which maintains SOC 2 Type II, ISO 27001, and HITRUST certifications.
- Data centers have physical access controls, environmental protections, and 24/7 monitoring.
7.4 Reporting Security Incidents
If you discover a security vulnerability or suspect a breach, please report it immediately to security@providerplexus.com. We investigate all reported incidents promptly.
8. Cookies and Tracking Technologies
8.1 Cookies We Use
Our cookie usage differs by Service. The categories below describe every cookie set across our properties.
- Essential Cookies (all web Services): First-party cookies required for authentication, session management, CSRF protection, and core functionality (for example, the Flask session cookie). These are exempt from consent under applicable law because the Services cannot function without them.
- Payment Cookies (patient telehealth portal only): When you reach the payment step of the intake flow at
providerplexus.com, Stripe, Inc. sets two functional cookies (__stripe_midand__stripe_sid) used solely for payment fraud prevention. These cookies do not track you across unrelated websites and are not used for advertising. - Analytics Cookies (non-essential — set only if you accept): Google Analytics 4, operated by Google LLC, measures page and feature usage on our web Services and sets cookies in your browser to do so. These cookies are not set unless you accept the analytics category in the cookie banner described in section 8.2. If you choose "Essential cookies only", or make no choice at all, the Google Analytics tags are never sent to your browser and no Google Analytics cookie is created.
- Product Analytics Without Cookies (Mixpanel): Mixpanel collects limited product analytics from
app.providerplexus.com, the telehealth/beginjourney, and production releases of the Provider Plexus mobile application. The web Services do not run a Mixpanel browser SDK: events are sent to a first-party Provider Plexus endpoint on our own domain and forwarded to Mixpanel from our servers, so Mixpanel sets no cookie in your browser. The mobile SDK uses an anonymous identifier for app-open, successful login/logout, and controlled home-tab events; automatic event collection and IP-based geolocation are disabled. No PHI, patient or user identifiers, contact information, clinical content, messages, files, or audio/video content is transmitted to Mixpanel. - Error Telemetry (provider web Services): Runtime error reports are sent to a same-origin Provider Plexus endpoint and retained in Provider Plexus's Google Cloud logging environment. Error fields are bounded and scrubbed before storage, and session replay is not collected.
8.2 Your Cookie Choices
The first time you visit a web Service that would set a non-essential cookie, we show a banner offering two choices: Accept analytics cookies or Essential cookies only. No choice is required to use the Services, and until you accept we treat your visit as essential-only — that is the default, and it is also what applies if you dismiss the banner or never answer it.
Your choice is recorded in a first-party cookie named pp_cookie_consent. It stores only the choice you made, contains no identifier, and expires after one year. To change your choice, delete that cookie in your browser settings and reload the page; the banner is then shown again.
You can also control cookies through your browser settings. Disabling essential cookies will prevent you from using the Services. Disabling payment fraud-prevention cookies may cause Stripe to decline transactions. Declining or disabling analytics cookies will not affect core functionality.
8.3 Do Not Track
The Services do not currently respond to "Do Not Track" (DNT) browser signals due to the lack of an industry-wide standard for DNT implementation.
9. Children's Privacy
The Services are not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13 except as part of the telehealth intake process when a parent or legal guardian provides information on behalf of a minor patient. If we learn that we have collected personal information from a child under 13 without parental consent outside of the healthcare context, we will delete that information promptly.
10. State-Specific Privacy Rights
10.1 California (CCPA/CPRA)
If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to delete, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination. Note that PHI handled under HIPAA is exempt from the CCPA. To exercise your CCPA rights, contact privacy@providerplexus.com.
10.2 Other State Laws
Residents of states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others) may have additional rights regarding their personal information. We will honor applicable rights under your state's privacy law. Contact privacy@providerplexus.com to exercise your rights.
11. International Data Transfers
The Services are hosted in the United States. If you access the Services from outside the United States, your information may be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Services, you consent to such transfers. Where required by applicable law, we implement appropriate safeguards (such as Standard Contractual Clauses) for cross-border data transfers.
12. Third-Party Links and Services
The Services may contain links to third-party websites or integrate with third-party services. This Policy does not apply to information collected by third parties. We encourage you to review the privacy policies of any third-party services you interact with through the Services.
13. Changes to This Policy
We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we do, we publish the updated Policy on the Services with a new effective date and a new version identifier, and we record what changed in the version history below. The Effective Date, Last Updated date, and Version shown at the top of this page identify the revision you are reading.
We do not send individual email notifications for routine changes to this Policy. The version history below is the record of what changed and when, and it is the mechanism by which we communicate changes. Where applicable law requires individual notice, or your consent, before a particular change takes effect — for example, a material change to how Protected Health Information is used or disclosed — we will provide that notice or obtain that consent before the change takes effect.
Your continued use of the Services after the effective date of any modification constitutes your acceptance of the updated Policy. We encourage you to review this Policy periodically.
13.1 Version History
- Version 2026.08.23 — effective August 23, 2026: Narrowed §5.2 to describe cryptographic key destruction as it actually operates: at the level of a terminated customer organization rather than an individual record, effective once the encrypted-backup retention period has elapsed, and carving out the records HIPAA requires us to retain for six years.
- Version 2026.08.22 — effective August 22, 2026: Added this version history and restated §13 to describe the change-notification practice we actually operate. Added §15, a privacy notice for workforce members (employees and contractors), an audience the notice previously did not address. Disclosed Google Analytics in §8.1, corrected the Mixpanel entry to state that the web Services set no Mixpanel cookie, and replaced §8.2 with the cookie-consent banner that now gates every non-essential cookie.
- Version 2026.08.03 — effective August 3, 2026: Expanded §8.1 to enumerate every cookie category set across our properties and described the Google Workspace API limited-use commitment.
- Version 2026.03.17 — effective March 17, 2026: Initial publication of the Data & Privacy Policy.
14. Contact Information
If you have questions, concerns, or requests regarding this Policy or our data practices, contact us:
- Privacy Inquiries: privacy@providerplexus.com
- Security Issues: security@providerplexus.com
- General Legal: legal@providerplexus.com
- Support: support@providerplexus.com
If you believe your privacy rights have been violated, you also have the right to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr.
15. Privacy Notice for Workforce Members
Sections 1 through 12 describe information we handle on behalf of customers, providers, and patients. This section describes the information we hold about Provider Plexus employees, contractors, and other workforce members (as that term is used in 45 CFR 160.103) because they work for or with us. It applies to you in addition to, not instead of, any notice you receive under your employment or contracting agreement.
15.1 Information We Hold About Workforce Members
- Identity and contact information: name, work email address, telephone number, and the account credentials used to access our systems.
- Role and credentialing information: role, health system assignment, licensure and NPI where applicable, and the permission and subscription assignments that determine what you can see in the Services.
- Access and audit records: authentication events, multi-factor and trusted-device registrations, and the audit record of what information you viewed or changed. These records exist because the HIPAA Security Rule requires them.
- Security telemetry: IP address, browser and device characteristics, and bounded application error reports generated by your use of internal tools.
- Training and compliance records: completion of HIPAA and security awareness training, policy acknowledgements, and the outcome of any screening required for your role.
15.2 How We Use It
Workforce information is used to administer your access, to operate and secure the Services, to meet HIPAA workforce training, sanction, and audit obligations, and to administer the employment or contracting relationship. We do not sell workforce information, we do not use it for advertising, and we do not use it to build profiles unrelated to your work. Where human resources, payroll, or benefits administration is carried out by a third-party provider, that provider's own privacy notice governs the records it holds.
15.3 Retention and Your Choices
Access and audit records are retained for the period required by the HIPAA Security Rule and our retention schedule. They are not deleted or amended on request, because their completeness is itself the control they exist to provide. Workforce members may ask what information we hold about them, ask us to correct inaccurate identity, role, or credentialing information, and raise a privacy concern, by emailing privacy@providerplexus.com. Raising a privacy concern will not result in retaliation.