Halo builds AI agents for independent medical practices. Practices trust us with their patients’ information, and we treat that trust as the most important thing we hold. This policy explains what we collect, why, and the choices you have.
This Privacy Policy applies to Halo Medical Solutions, Inc. (“Halo,” “we,” “us,” or “our”), our website at halohealth.app (the “Site”), and our Scribe, Receptionist, and Billing products and related services (together, the “Services”).
When we handle patient information for a medical practice, we do so as that practice’s business associate under HIPAA. That handling is governed by our agreement with the practice, including a Business Associate Agreement (“BAA”), which controls if it conflicts with this policy.
1. Information we collect
Information you give us
When you book a consultation, contact us, sign up, or use the Services, you may give us your name, email address, phone number, job title, practice name, practice details such as specialty, size, and the systems you use, and anything you choose to include in a message. Customers also give us account, billing, and payment details.
Information collected automatically on our Site
When you visit the Site, we and our analytics and advertising partners automatically collect information such as your IP address, approximate location, browser and device type, pages viewed, referring pages, links clicked, and the dates and times of your visits. We collect this using cookies, pixels, and similar technologies, described in Section 7.
Information we process for practices
To provide the Services, we process information on behalf of the practices we work with. Depending on the products a practice uses, this can include:
- Scribe: audio from clinical visits, transcripts, visit notes, codes, orders, and chart information from the practice’s EMR.
- Receptionist: phone calls and recordings, transcripts, text messages, appointment details, and insurance and demographic information that callers share.
- Billing: eligibility and coverage information, claims, remittances, payment postings, and related clinical documentation.
Much of this information is protected health information (“PHI”). We use and disclose PHI only as allowed by our agreements with the practice, including the BAA, and by HIPAA. Section 4 covers this in more detail.
2. How we use information
We use the information we collect to:
- provide, operate, maintain, and support the Services;
- respond to inquiries, schedule consultations, and communicate with you about Halo;
- create and manage accounts, process payments, and send service notices;
- understand how the Site is used and improve it;
- measure the performance of our marketing, including advertising for Halo;
- protect the security and integrity of the Site and Services and prevent fraud and misuse; and
- comply with legal obligations and enforce our agreements.
We never use PHI for marketing or advertising, and we never use it to target ads.
4. Patient information and HIPAA
Medical practices are “covered entities” under HIPAA, and Halo works for them as a “business associate.” When we handle PHI, we commit to the following:
- We use and disclose PHI only to provide the Services to the practice, as permitted by the BAA, or as required by law.
- We limit use and disclosure of PHI to the minimum necessary.
- We keep administrative, physical, and technical safeguards to protect PHI, and we log access to it.
- We report security incidents and breaches of unsecured PHI to the practice as required by the BAA and HIPAA.
- We do not use identifiable PHI to train general-purpose AI models. Any data used to improve the Services is first de-identified under HIPAA’s standard (45 C.F.R. § 164.514).
If you are a patient, your provider controls your health information. To access, correct, or ask about it, please contact your provider directly. We will help your provider respond to your request.
5. AI and automated processing
Our agents use artificial intelligence, including speech recognition and large language models, to transcribe, summarize, draft, code, and route information. AI output is meant to support a practice’s team, not to replace professional judgment. Practices remain responsible for reviewing and approving clinical documentation, codes, and claims before they are used. The AI providers we use process data under agreements that prohibit them from training their models on our customers’ data.
6. Calls and text messages
When you call a practice that uses Receptionist, you may be speaking with an AI agent, and the call may be recorded and transcribed for the practice. If you receive text messages from a practice through Halo, message and data rates may apply. You can reply STOP at any time to opt out or HELP for help. We do not sell or share mobile numbers or text messaging consent with third parties for their marketing.
8. Security
We protect information with safeguards that include encryption in transit and at rest, role-based access controls, audit logging, vendor review, and HIPAA training for our team. No system is perfectly secure, but we work hard to protect your information, and we respond promptly to any incident.
9. Retention
We keep personal information only as long as we need it for the purposes in this policy, to comply with our legal obligations, resolve disputes, and enforce our agreements. We keep PHI as directed by the practice and the BAA, and return or destroy it when our agreement ends, as the BAA requires.
10. Your choices and rights
Depending on where you live, you may have the right to know what personal information we hold about you, and to access, correct, delete, or receive a copy of it. You can also unsubscribe from marketing emails at any time with the link in the email.
California residents. Under the California Consumer Privacy Act, you have the rights to know, delete, and correct personal information, to opt out of its sale or sharing, and to not be discriminated against for using these rights. We do not sell or share personal information as those terms are defined under California law. This policy describes the categories of personal information we collect, where they come from, and why.
Other states. Residents of other states with consumer privacy laws may have similar rights.
To make a request, email us at the address below. We will verify your request and respond within the time required by law. You may also use an authorized agent. Requests about patient information will be referred to your provider, as described in Section 4.
11. Children
The Site and Services are intended for medical practices and their staff, not for children. We do not knowingly collect personal information from children under 16 through the Site. Practices may use the Services for patients of any age, and that information is handled as PHI under the BAA.
12. Third-party sites and services
The Site may link to services we don’t control, such as scheduling tools and integration partners. Their privacy practices are governed by their own policies.
13. Changes to this policy
We may update this policy from time to time. When we do, we will change the “Last updated” date above. If we make material changes, we will give additional notice, such as on the Site or by email.
14. Contact us
Questions or requests about privacy? Contact us at:
Halo Medical Solutions, Inc.
2609 Tranquil Avenue NW, Olympia, WA 98502