Privacy Policy

Effective: August 31, 2026  ·  Last updated: August 31, 2026

HyperClinic AI LLC (“HyperClinic,” “we,” “us”) provides software to medical practices: Patient Check‑In, Provider Scribe, and Website & SEO management. This policy explains what information we collect, how we use it, and the choices you have. It covers our website at hyperclinic.ai, our platform at admin.hyperclinic.ai, and the text messages our software sends on behalf of the practices that use it.

1. Text messaging (SMS)

Our Patient Check‑In product sends text messages to patients on behalf of the medical practice they have an appointment with. The practice is the sender; HyperClinic is the software that delivers the message.

Mobile information is never shared

How consent is obtained

The medical practice collects a patient’s mobile number and their agreement to receive appointment messages, as part of registration or scheduling. HyperClinic does not buy, rent, or import phone lists, and we do not message anyone whose number was not given to their own practice by the patient.

Message frequency

Message frequency varies and depends on your appointments. In normal use our software sends at most one message per appointment — a single arrival message shortly before the visit. No further message is sent for that appointment once it has been sent, once the patient has arrived or checked in, or if the appointment is cancelled. Messages are suppressed during the practice’s configured quiet hours. A practice’s staff may separately send a patient a link to complete intake forms.

Rates

Message and data rates may apply. HyperClinic and the practice do not charge you for these messages; your mobile carrier may.

Opting out and getting help

Reply STOP to any message to stop receiving texts. STOP, QUIT, END, CANCEL, REVOKE, OPT OUT and UNSUBSCRIBE are all recognised, and you may also withdraw consent by any other reasonable means — including simply telling the practice’s front desk or calling them. Reply START if you later want messages again.

We record an opt‑out immediately, which is sooner than the ten business days the Federal Communications Commission allows. An opt‑out applies to all appointment messages from that practice, not only the one you replied to. Reply HELP for help, or contact the practice directly.

What is in the message

Appointment messages are deliberately minimal. They contain only the practice’s name and a secure link. They do not contain a patient name, a provider name, an appointment time, a location, a reason for visit, or any clinical information — so a message seen on a lock screen by someone else discloses nothing about the patient’s care. This restriction is enforced by the software, not by convention.

Carriers may filter or delay messages; delivery is not guaranteed.

2. Information we collect

a. Website visitors and prospective clients

If you visit our website or contact us, we may collect your name, business email address, phone number, practice name, and what you told us you were interested in. We collect standard server and analytics information such as IP address, browser type, and pages viewed.

b. People who use the platform (practice staff and HyperClinic staff)

Accounts are created through Google Sign‑In. We receive your name, email address, and Google account identifier — never your Google password. We record your role, the practice you belong to, and an audit record of security‑relevant actions you take, including when you open patient information.

c. Patient information handled for a practice

When a practice uses our software, we process information about its patients on that practice’s behalf: name, date of birth, chart or medical record number, mobile number, appointment details, the answers a patient gives on intake forms, uploaded insurance cards and identification, and clinical documentation produced by Provider Scribe.

3. How we use information

• To operate the products a practice has purchased: sending appointment messages, collecting intake forms, producing and delivering completed documents, drafting clinical notes, and managing the practice’s website and reviews.
• To authenticate users, enforce permissions, and keep the audit records that HIPAA requires.
• To provide support, investigate problems, and keep the service secure and reliable.
• To bill practices and to communicate with them about their account.
• To meet legal obligations.

We do not use patient information to advertise or market anything, to ourselves or to anyone else. We do not sell personal information, and we do not share it for cross‑context behavioural advertising.

4. Artificial intelligence

Provider Scribe uses Google Vertex AI to draft clinical notes from a visit. The draft is a starting point: a clinician reviews and signs the note, and nothing enters a patient’s chart without that. Content sent to the model is processed under Google Cloud’s enterprise terms and is not used to train general‑purpose models.

5. Who we share information with

We share information only as described here.

Where a service provider may handle protected health information, we require a written agreement with it, including a HIPAA business associate agreement where one applies. Mobile phone numbers and SMS opt‑in consent are excluded from every sharing arrangement above except delivery of the message itself.

6. How we protect information

• Encrypted in transit and at rest.
• Access is capability‑based: a person sees only what their role at their own practice permits, and a practice can never reach another practice’s data.
• Every read of patient data is recorded — who, what, and when.
• Sessions end automatically after a period of inactivity.
• Payment card numbers, card security codes, bank account details and passwords are refused by our intake forms and are never collected or stored.

No system is perfectly secure. If a breach of unsecured protected health information occurs, we notify the affected practice without unreasonable delay and in no case later than 60 calendar days after discovery, as 45 CFR §164.410(b) and our business associate agreement require. The practice, as the covered entity, decides what notice goes to patients.

7. How long we keep information

Patient information

We keep it for as long as our agreement with the practice requires, and no longer. The retention period itself is the practice’s to set, not ours — the legal duty to keep medical records falls on the physician and the practice, not on their software vendor. In Texas, for example, a physician must keep an adequate medical record for at least seven years from the last treatment, and for a patient who was a minor, until the patient turns 21 or seven years from the last treatment, whichever is longer (Texas Medical Board Rule 22 TAC §165.1(b)). We hold information for the practice so that it can meet obligations like that one; we do not decide them.

When our agreement with a practice ends, we return or destroy the protected health information we still hold and keep no copies. Where returning or destroying it is not feasible — encrypted backups on a fixed expiry cycle, and audit records that are deliberately immutable — we continue to protect it under the same terms and stop using it for anything else, which is what 45 CFR §164.504(e)(2)(ii)(J) requires.

Audit records

We keep them for at least six years. To be precise about why: HIPAA requires that the documentation the Security Rule calls for be retained for six years from creation or from the date it was last in effect (45 CFR §164.316(b)(2)(i)). The rule requiring audit controls (§164.312(b)) sets no retention period of its own. Six years for the logs themselves is our choice, applied to match the documentation standard.

Everything else

Website enquiry and account information is kept only as long as it is useful, and you can ask us to delete it. An SMS opt‑out is kept indefinitely and deliberately — deleting it is how a number gets messaged again by mistake.

8. Your choices and rights

• Text messages: reply STOP at any time.
• Marketing email from us: use the unsubscribe link.
• Your medical records: contact your practice, not us. See section 2(c).
• Website and account information: email us to access, correct, or delete it.

State privacy laws generally do not reach the patient information we hold. The Texas Data Privacy and Security Act exempts HIPAA business associates at the entity level, and exempts protected health information at the data level; that information is governed by HIPAA and by our agreement with the practice instead. Comparable laws in other states exempt it on the same basis.

We would rather not lean on that. For the information we hold in our own right — a website enquiry, a contact record, a platform user account — we will honour a request to see it, correct it, or delete it whether or not a statute compels us to, and we will answer within 45 days. We do not sell personal information and we do not use it for targeted advertising, so there is nothing to opt out of on that front. We will not treat you differently for exercising a privacy right.

For patient records, the request belongs with your practice: HIPAA gives you a right of access to your own records from the covered entity that holds them, and we would only be able to act on the practice’s instruction anyway.

9. Children

Our platform is for medical practices and their staff; it is not directed at children and we do not knowingly collect information from a child through our website. Where a practice’s patient is a minor, that information is handled for the practice under the same business associate terms as any other patient information, in line with the practice’s own policies and applicable law.

10. Terms of Service

Your practice’s use of the platform is governed by our Terms of Service, and our handling of protected health information is governed by the Business Associate Agreement between us. Where any of them conflict on protected health information, the Business Associate Agreement controls.

11. Changes to this policy

If we change this policy we will update the date at the top and post the new version at this address. If a change materially affects how we handle personal information we will tell the practices we work with directly.

12. Contact us

© 2026 HyperClinic AI LLC. All rights reserved.