GELYPTIC MD Privacy Policy

1. Scope of This Policy

This Privacy Policy describes how GELYPTIC MD collects, uses, discloses, and protects information when you use our ambient clinical documentation platform, developer APIs, Academy training portal, and related services (collectively, the "Service"). It applies to healthcare providers, clinic staff, developer partners, and website visitors.

When GELYPTIC MD processes Protected Health Information ("PHI") on behalf of a covered entity or another business associate, that processing is additionally governed by the Business Associate Agreement ("BAA") executed between the parties. In the event of a conflict between this Policy and an executed BAA, the BAA controls with respect to PHI.

2. Information We Collect

• Account Information: Name, email address, professional role, clinic affiliation, and authentication credentials you provide when creating an account.
• Consultation Audio (Transient): Audio recordings of clinical encounters you choose to record. Audio is processed transiently for transcription and is not retained after the note is delivered (see Section 3).
• Clinical Text: Draft SOAP notes, referral and appeal letters, and related clinical text generated through the Service, stored in your account until you delete them.
• Usage and Technical Data: Log data, device and browser type, IP address, feature usage, and error diagnostics used to operate, secure, and improve the Service.
• Developer Data: API key metadata, request logs (request IDs, timestamps, endpoints, status codes), and webhook delivery records. API request and response bodies containing PHI are not logged.

3. Data Minimization & Zero-Retention Audio Policy

GELYPTIC MD is built on a foundational philosophy of data minimization. Your patient conversations are confidential, and we treat them as such:

• Audio Data Processing: When a clinician records a consultation, the audio stream or file is transmitted securely using encryption in transit (TLS 1.2/1.3) to our transcription processing pipeline.
• Immediate Deletion: Once the text transcription and structured SOAP note are delivered, the raw audio file is permanently deleted from our processing systems. We do not keep, log, store, or archive the audio files.
• No AI Training on Patient Data: GELYPTIC MD explicitly guarantees that your clinical text outputs and patient audio files are never used, cached, or sold to train public large language models (LLMs) or speech-to-text algorithms.
• Offline Capture: Recordings captured while offline are encrypted on your device (AES-GCM) and remain local until you choose to upload them for processing.

4. How We Use Information

• To provide, operate, and maintain the Service, including transcription, note generation, coding suggestions, and EHR export.
• To authenticate users, enforce access controls, and maintain audit trails required for security and compliance.
• To communicate with you about your account, security events, and service updates. Marketing communications are optional and can be unsubscribed at any time.
• To produce de-identified, aggregated analytics (for example, public-health signal summaries) that cannot reasonably be used to identify any individual, in accordance with the HIPAA de-identification standard at 45 CFR §164.514.
• To comply with legal obligations and enforce our agreements.

We do not sell personal information or PHI, and we do not use PHI for advertising.

5. HIPAA Alignment

• Business Associate Agreements: We execute BAAs with covered entities and downstream business associates before PHI is processed through the Service, and we require BAAs from our own subcontractors that handle PHI.
• Safeguards: Administrative, technical, and physical safeguards aligned with the HIPAA Security Rule, including encryption at rest (AES-256) and in transit (TLS 1.2+), role-based access control, clinic-scoped data isolation, audit logging, and workforce access on a least-privilege basis.
• Breach Notification: We will notify affected customers of any breach of unsecured PHI without unreasonable delay and in no case later than 60 days after discovery, consistent with 45 CFR §§164.400–414, and will cooperate with customer notification obligations.
• Minimum Necessary: Access to PHI is limited to the minimum necessary to perform the requested function, enforced through scoped API keys and role-based permissions.

6. Your Rights and Choices

• Access and Export: You may access and export your clinical notes and account data at any time through the Service.
• Correction and Deletion: You may correct or delete your notes and request deletion of your account by contacting us. Deletion requests are honored subject to legal retention obligations and the terms of any executed BAA.
• Patient Rights: Patients whose information is processed through a customer's use of the Service should direct access, amendment, or accounting requests to their healthcare provider (the covered entity). We will reasonably assist our customers in responding to such requests as required by the BAA.
• GDPR / UK GDPR / NDPR: Where applicable, you have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your supervisory authority. Our legal bases for processing are performance of a contract, legitimate interest in securing and improving the Service, and legal obligation.

7. Data Retention

Consultation audio is deleted immediately after transcription. Clinical notes remain in your account until you delete them. Audit logs and security records are retained for up to six (6) years to satisfy HIPAA documentation requirements. Upon account termination, remaining data is deleted or de-identified within ninety (90) days unless a longer retention period is required by law or an executed BAA.

8. Third-Party Subprocessors

To provide our multilingual capabilities, GELYPTIC MD uses secure infrastructure and AI processing partners (including zero-data-retention API endpoints). Each subprocessor that may handle PHI is contractually bound through a BAA or equivalent data-processing agreement to process data transiently, with strict privacy protocols, ensuring your data never enters public AI training pools. A current list of subprocessors is available on request at support@gelypticmd.com.

9. International Transfers

GELYPTIC MD serves a global customer base. Where personal data is transferred across borders, we rely on appropriate safeguards such as standard contractual clauses and respect regional data protection frameworks (including Nigeria's NDPR and East African data protection laws). Because patient audio is processed transiently, cross-border exposure of PHI is minimized by design.

10. Security

We maintain encryption at rest and in transit, clinic-scoped row-level data isolation, scoped and revocable API keys stored as SHA-256 hashes, signed webhooks, audit trails, and rate limiting. No method of transmission or storage is 100% secure; if you suspect unauthorized access to your account, contact us immediately.

11. Children's Privacy

The Service is intended for licensed healthcare professionals and is not directed at children. We do not knowingly collect account information from anyone under 18.

12. Changes to This Policy

We may update this Policy from time to time. Material changes will be announced in the app or by email at least thirty (30) days before they take effect. The "Last Updated" date above reflects the most recent revision.

13. Contact Us

Privacy questions, data requests, and breach reports: support@gelypticmd.com.