Privacy Policy
Draft for review. This is not yet legal advice.
Who we are
Hia AI ("Hia", "we", "us") makes Hia, an AI-native operating system for behavioral health and wellness practitioners. Hia brings together an AI assistant, an electronic health record, practice operations, client communications, billing and the Hia Network in one place.
This policy explains what information we collect, why we collect it, how we protect it, and the choices you have. If you have a question at any point, email privacy@gethia.com or write to us at [Company address].
Who this policy covers
Hia is used by several groups of people, and our role is different for each:
- Practitioners and their teams, who hold accounts with us. For their account information, we decide how it is used.
- Clients of practitioners, whose health information a practitioner stores or creates in Hia. For this information, we act on the practitioner's behalf as a data processor (under India's Digital Personal Data Protection Act, 2023, the GDPR and similar laws), a business associate (under HIPAA) or a service provider (under Canadian privacy law). The practitioner remains responsible for their clients' records and decides how they are used.
- Brand partners, such as wellness apps, telehealth companies, employers and insurers that book practitioners through the Hia Network.
- Website visitors, who browse gethia.com or contact us.
What we collect
From practitioners
- Account details: name, email, phone number, practice name, role and login information.
- Professional details: licensure, credentials, specialties, insurance panels, and background-check results where you opt into the Hia Network.
- Billing details: subscription plan, payment method (handled by our payment processor) and payout information.
- Usage information: how you use Hia, settings, device and browser details, and log data.
About clients of practitioners
When a practitioner uses Hia, we process protected health information (PHI) and other personal information on their behalf. This can include contact details, appointments, intake forms, clinical notes, treatment plans, assessment scores, messages, insurance and payment details, and, where the practitioner turns them on, session recordings, dictations and transcripts. We process this information only to provide Hia to the practitioner and as our agreements with them allow.
From brand partners
Business contact details, company information, API and integration settings, booking records, and billing and invoicing information.
From website visitors
Information you choose to send us, such as your name and email in a demo or contact form, plus basic technical data like IP address, browser type, pages viewed and referring site.
How we use information
We use information to:
- Provide, maintain and secure Hia, including the EHR, scheduling, communications, billing and the Hia Network.
- Generate notes, summaries and other drafts with the Hia AI assistant when a practitioner asks it to.
- Verify practitioners who join the Hia Network.
- Process payments, invoices and payouts.
- Provide support and send service messages, such as security alerts and billing notices.
- Improve how Hia works, using account and usage information. We do not use client health information for product analytics unless it has been de-identified in line with applicable law.
- Meet legal, regulatory and contractual obligations.
We send marketing emails only to practitioners, partners and visitors who have agreed to receive them, and you can unsubscribe at any time.
AI processing
The Hia AI assistant can listen to a session or a dictated summary and draft a clinical note and related documents. Here is how we handle that:
- Purpose only. Recordings, dictations and transcripts are processed only to produce the outputs the practitioner asked for.
- Never sold. We do not sell client information, and we do not sell recordings or transcripts.
- Never used to train models. We do not use client information, recordings or transcripts to train AI models, and our AI sub-processors are contractually barred from doing so.
- Recordings are deleted. Audio recordings are deleted once the note has been generated, unless the practitioner chooses to keep them. Transcripts and notes become part of the client record the practitioner controls.
- A human reviews. AI drafts are suggestions. The practitioner reviews, edits and approves every note before it is finalized.
Practitioners are responsible for getting any consent their clients need before a session is recorded or processed by AI.
How we share information
We do not sell personal information. We share it only as follows:
- Sub-processors. We use trusted vendors for hosting, AI processing, communications, payments and support. Each one is bound by a written agreement, including a business associate agreement where PHI is involved, and may use information only to provide services to us. A current list is available on request at privacy@gethia.com.
- Hia Network bookings. When a brand partner books a practitioner, we share only what is needed to arrange and deliver that booking, such as the practitioner's professional profile, availability and verification status, and the booking details. Client clinical records are not shared with brands unless the practitioner and client have authorized it, or the law requires it.
- At a practitioner's direction. For example, when a practitioner sends a referral letter, submits an insurance claim or connects an integration.
- Legal reasons. To comply with law, a valid legal process, or to protect the rights, safety and security of our users, clients or the public.
- Business changes. If Hia AI is involved in a merger, acquisition or sale of assets, subject to the same protections described here.
Security
We protect information with administrative, technical and physical safeguards designed to meet the expectations of India's DPDP Act, the GDPR, the UAE and Saudi personal data protection laws, HIPAA and PIPEDA. These include encryption in transit and at rest, role-based access controls, multi-factor authentication, audit logging, regular security testing and staff training. A data processing agreement is available to practitioners and brand partners, and a business associate agreement (BAA) to practitioners in the United States. No system is perfectly secure, and we will notify affected users and regulators of a breach as the law requires.
Retention
We keep account information while your account is open and for a reasonable period after, as needed for legal, tax and audit purposes. Client records are kept for as long as the practitioner keeps them in Hia. When a practitioner closes their account, we give them a chance to export their data and then delete or de-identify it within [retention period], unless the law requires us to keep it longer. Practitioners remain responsible for meeting the record-keeping rules of their profession and jurisdiction.
Your rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you.
- Correct information that is inaccurate.
- Delete your information, or ask us to stop using it.
- Receive a copy of your information in a portable format.
- Object to or restrict certain uses, and withdraw consent.
- Complain to a privacy regulator.
India
Under the Digital Personal Data Protection Act, 2023, you can ask for a summary of the personal data processed about you, correct or erase it, withdraw consent as easily as you gave it, and nominate someone to exercise your rights if you cannot. For clients of practitioners, the practitioner is the Data Fiduciary and we process data on their behalf. You can raise a grievance with our Grievance Officer, [name], at [grievance email], and we will respond within the time the law requires. If you are not satisfied, you may complain to the Data Protection Board of India.
Singapore, Australia and the wider Asia-Pacific
Under laws such as Singapore's PDPA and Australia's Privacy Act, you can access and correct your personal information and withdraw consent. When we transfer information across borders, we protect it to a comparable standard.
United Arab Emirates, Saudi Arabia and the Middle East
Under the UAE and Saudi personal data protection laws, you can access, correct and delete your information, and object to certain processing. Health data is stored and transferred only as those laws and local health-data rules allow.
United States
Clients' rights under HIPAA to access, amend or get an accounting of their health records are exercised through their practitioner, who controls the record. We support practitioners in responding to these requests.
Canada
Under PIPEDA and provincial laws such as Ontario's PHIPA, you can access and correct your personal information and withdraw consent, subject to legal limits. Health record requests go to the practitioner who is the health information custodian.
European Union, UK and similar regions
Where GDPR-style laws apply, you have the rights listed above. We rely on contract, legitimate interests, consent or legal obligation as our legal bases, and on appropriate safeguards for any international transfers.
To make a request, email privacy@gethia.com. If you are a client of a practitioner, we will usually pass your request to them. We will not discriminate against you for exercising your rights.
Cookies
Our website uses essential cookies to work properly, and, with your permission where required, analytics cookies to understand how it is used. You can manage cookies through your browser or our cookie settings. We do not use advertising cookies inside the Hia app.
Children
Hia is built for professionals and businesses, and our website is not directed at children. Practitioners may store information about clients who are minors, which they manage under the laws that apply to their practice. We do not knowingly collect information directly from children through our website.
Changes to this policy
We may update this policy as Hia changes or as laws evolve. We will post the new version here with a new date, and tell account holders about significant changes before they take effect.
Contact us
Questions, requests or concerns? Email privacy@gethia.com or write to Hia AI, [Company address].