Privacy Policy

1. Information We Collect

Agency & clinician account data: name, email, phone, role, credential, NPI, license details, billing identifiers from Stripe, agency configuration you enter (state, services, payers, NPI/EIN, etc.), and usage telemetry.

Patient data (PHI): when you enter or import patient information you act as a HIPAA Covered Entity and AgenciesForge acts as your Business Associate. PHI includes patient demographics, diagnosis codes (ICD-10), medication lists, session notes, claims, eligibility checks, outcome assessment scores, secure messages, and voice-dictation audio. PHI is encrypted at rest with AES-256-GCM (see section 6).

Voice-dictation audio: when a clinician taps the AI Forge mic, audio is captured in the browser via MediaRecorder, streamed in 3-second chunks to our server, and transcribed via Google Cloud Speech-to-Text under the Google Cloud BAA. Audio is not retained beyond the transcription latency window.

AI Forge (third-party AI):AI Forge is an optional assistant. When you use it, the text you enter, dictation audio, attached images, and the specific chart data relevant to your request are sent to Anthropic’s Claude models running on Amazon Web Services (AWS Bedrock) — a HIPAA-eligible service under our AWS BAA (see section 3) — to generate the response. This data is used only to provide the feature; it is never used to train AI models, for advertising, or shared with data brokers. In our mobile app you are shown this disclosure and asked for your permission before AI Forge sends any data, and you can use the rest of the platform without it.

Website analytics:on our public marketing pages (not the signed-in app or patient portal) we record, with a random first-party identifier stored in your browser, which pages you view, how long you actively read and how far you scroll, the buttons and links you click, that you copied text or started a form (never what you typed), your device type, browser, screen size, language, time zone, approximate location derived from your connection (looked up through IPinfo, which receives your IP address for that lookup), and the site or campaign that referred you. If you give us your email or start checkout, we connect it to that browsing history so we can follow up on what you looked at. We do not store your IP address with this record, we do not sell it or share it with ad networks, and it is deleted automatically after about 13 months. Choose “Essential only” on the cookie banner, or send a Global Privacy Control signal, and none of this is recorded.

Signup form:when you use Create Account, we save what you enter in the name, email, and referral code fields, the plan and payment option you choose, the steps you complete, and any error messages the form shows you, even if you do not finish. We never save your password (only whether it met our password rules). We use this to follow up if something went wrong and to make signup easier. “Essential only” and Global Privacy Control turn this off as well.

Revenue-leakage check and the payer benchmark: the free check at /leakage-checkruns entirely in your browser. The billing export you load is read and analysed on your own device; it is never transmitted to us and never stored anywhere. Two things can leave that page, and only when you press a button for them. First, if you ask for a copy of your results, we receive your email address. Second, if you choose to contribute to the payer benchmark, we receive — for each payer and procedure code — the median amount paid per unit, how many paid claims that median was computed from, and counts of denied claims by reason code. Nothing else. There is no patient information in it, no claim-level rows, no service dates, and no identifier for you or your practice, and the endpoint refuses any field it was not built to accept rather than quietly dropping it. Contributions are pooled with other practices’, and a pooled figure is only ever shown once at least three separate practices stand behind it, so that publishing it cannot reveal any one practice’s rates. Because a contribution carries nothing that identifies where it came from, we cannot tell which one is yours, and therefore cannot retrieve or delete an individual contribution afterwards — if that matters to you, do not use the contribute button.

2. How We Use Information

To deliver and improve the platform, generate certification documents, run AI-assisted clinical/billing workflows, process payments, communicate operational updates, and maintain HIPAA security & audit trails. PHI is used only for the Treatment, Payment, and Health Care Operations purposes specified in your BAA — never for marketing, model training, or analytics.

To find and fix parts of the dashboard that are hard to use, we record product usage signals inside the signed-in app: which screens are opened, clicks that do nothing or are repeated in frustration, errors, and failed or slow requests. This data is collected and stored by AgenciesForge only, within our own Google Cloud environment. It is never sent to third-party analytics or session-recording services. It never includes what you type, patient records, or screen recordings.

3. Subprocessors

AgenciesForge relies on the following subprocessors. Each one with PHI access has either a signed BAA, a HIPAA-eligible service offering under their master agreement, or is exempt from BAA requirements (payment processors).

• Amazon Web Services, Inc. (Bedrock) — Anthropic Claude model inference for all clinical AI features. AWS BAA covers Bedrock as a HIPAA-eligible service. All Claude calls in our production code route through AWS Bedrock; we make no direct API calls to Anthropic at runtime.
• Google LLC (Firebase, Google Cloud, Speech-to-Text) — authentication, Firestore database, Cloud Run application hosting, voice transcription. Google Cloud BAA covers all four under one agreement.
• Stedi, Inc. — clearinghouse for eligibility (270/271), claims (837P/I/D), 277CA acknowledgements, and 835 ERA. Stedi BAA effective 2025-04-14.
• Resend, Inc.— transactional email delivery (appointment reminders, patient-portal magic links, system notifications). Covered by Resend's Data Processing Addendum at resend.com/legal; minimal PHI exposure (patient first name + appointment time).
• Stripe, Inc. — subscription billing and payment-method storage. No PHI; payment processors are exempt from BAA requirements per 45 C.F.R. § 164.502(e)(1)(i).

We provide HIPAA-Covered customers at least 30 days' written notice before engaging a new subprocessor that will have access to their PHI. The current subprocessor list is maintained in docs/VENDOR_RISK_REGISTER.md in our repository and reflected in the Business Associate Agreement template at docs/BAA_TEMPLATE_v1.md.

4. Protected Health Information & the BAA

Customers operating in HIPAA-regulated workflows must execute a Business Associate Agreement before transmitting Protected Health Information. The current BAA template is available on request and lives at docs/BAA_TEMPLATE_v1.mdin our repository. The BAA governs PHI use, subcontractor flow-down, security controls, breach notification (within 10 business days of discovery), and the customer's rights to access, amendment, and accounting of disclosures (45 C.F.R. §§ 164.524, 164.526, 164.528).

If you submit PHI to AgenciesForge without a signed BAA in place, you may be in breach of HIPAA. We will treat any PHI received outside the BAA framework as if a BAA were in place — but we cannot retroactively grant the legal coverage required for your compliance posture.

5. Audit Logging & Data Retention

Every PHI read, write, export, and disclosure is recorded in an append-only audit log (per HIPAA § 164.312(b)). Audit entries include actor, action, IP, timestamp, and structural metadata only — never PHI body content. Audit logs are retained for at least six years per HIPAA § 164.530(j).

PHI is retained for the duration of your subscription plus six years thereafter, then deleted. You may request earlier deletion at any time by contacting privacy@agenciesforge.com — we'll honor the request within 30 days subject to legal retention obligations (e.g., active claims or audit holds).

6. Security Safeguards

• Encryption at rest: AES-256-GCM field-level encryption for sensitive PHI fields (DOB, email, phone, member ID, diagnosis codes, session-note narrative, secure-message bodies, full eligibility-271 payloads). Encryption key managed via Google Secret Manager; rotation playbook in our repository.
• Encryption in transit: TLS 1.2+ end-to-end; HSTS enabled on all customer-facing surfaces.
• Access controls: Firebase Auth with mandatory password policy, optional TOTP and/or passphrase second factor, per-agency role + capability matrix for team members.
• Audit logging: append-only audit log on every PHI access and mutation; retained for ≥6 years.
• Breach response: incident response runbook atdocs/IR_RUNBOOK.md; customer notification within 10 business days of breach discovery per BAA § 5.

7. Your Rights

You may request access, correction, export (FHIR R4 Bundle), or deletion of your data at any time by contacting privacy@agenciesforge.com. One exception, and it exists by design: aggregate figures you chose to contribute to the payer benchmark (Section 1) carry no identifier for you or your practice, so we have no way to find yours among other practices’ and cannot delete it on request. Nothing in those figures identifies a person, a patient or a practice. You can also delete your account and data yourself from Settings → Security → Danger zone (see how to delete your account). PHI rights flow through the Covered Entity (the agency) as specified in your BAA.

8. Contact

Privacy questions and HIPAA inquiries: privacy@agenciesforge.com
Security incidents: security@agenciesforge.com