Ace Health Privacy Policy

1. Overview & Commitment to Health Data Privacy

Ace78 Technologies ("Ace Health," "we," "us," or "our") is dedicated to protecting the privacy and security of patient Protected Health Information (PHI) and user personal data. This Privacy Policy describes how we collect, process, store, and safeguard data through our web applications, clinical portals, patient apps, ambient AI scribing services, and telephony integrations.

2. HIPAA Compliance & Business Associate Agreements (BAA)

Ace Health operates as a **Business Associate** under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and Health Information Technology for Economic and Clinical Health (HITECH) Act. We execute binding Business Associate Agreements (BAAs) with all covered healthcare entities prior to provisioning access to patient data streams.

3. Zero Audio Retention Policy for Ambient AI

For our ambient AI scribe and voice agent services:

• Audio recordings captured during patient encounters are streamed ephemerally in RAM exclusively for transcription and structured note drafting.
• Raw audio is permanently purged from memory immediately upon completion of the clinical SOAP note generation.
• We do not use patient clinical recordings to train public foundation models without explicit, de-identified institutional consent.

4. Data Encryption & Storage Standards

All data in transit is encrypted using TLS 1.3. All data at rest is encrypted using AES-256 bit encryption within FedRAMP authorized healthcare cloud infrastructure (AWS GovCloud / HIPAA-compliant US regions).

5. Information We Collect

• Account & Registration Details: Clinician names, NPI numbers, medical credentials, practice emails, and authentication credentials.
• Clinical Encounter Metadata: Encounter timestamps, EHR IDs, scheduling slots, and structured clinical summaries authorized by your healthcare provider.
• Communication Logs: Timestamped records of two-way SMS, patient portal tickets, and telephony routing strictly for audit logging.

6. How We Use Your Information

• Connect you with licensed healthcare providers
• Facilitate AI-assisted voice and messaging features
• Provide medical consultations and communication
• Store and manage your medical records
• Improve app functionality and user experience
• Send appointment reminders and notifications
• Comply with legal and regulatory obligations

7. How We Share Information

• Healthcare Providers: Doctors, clinics, and authorized medical professionals involved in your care.
• Service Providers: Cloud hosting providers, analytics, and technical vendors under strict confidentiality agreements.
• Legal Compliance: If required by court order, subpoena, government request, or public health reporting obligations.
• Business Transfers: In the event of a merger, acquisition, or asset sale.

8. Third-Party AI and Automated Processing

Ace Health uses third-party artificial intelligence operated by OpenAI, Inc. when you engage AI-assisted features. Data is sent over encrypted connections. We do not sell your personal or health information to OpenAI.

• Features: AI-assisted text chat, AI voice calls, voice message transcription, and summaries for your care team.
• Data Sent: Messages, voice audio, transcripts, and limited profile context required for summaries.
• Human Oversight: AI-generated content is reviewed by your clinic's care team. The AI does not diagnose conditions or prescribe medication.

9. Your Rights & Data Retention

Depending on applicable laws, you may have the right to access, correct, or request deletion of your personal information. If HIPAA applies, you may also request an accounting of disclosures or restrictions on certain disclosures.

We retain health and personal data as required by HIPAA, state medical record retention laws, and healthcare regulations. When no longer required, data will be securely deleted or de-identified.

10. Children's Privacy

Our Services are not intended for children under 13 without parental consent. If we become aware that we have collected personal information from a child without verified parental consent, we will take steps to delete such information.

11. Contact Our Privacy & Compliance Officer

If you have questions regarding this Privacy Policy, your rights under HIPAA, or our compliance posture, please contact our Data Protection Officer: