Privacy Policy: Ambient Clinical Intelligence Platform

Effective Date: October 13, 2026

This Privacy Policy describes how Oncology Solutions LLC (“Company,” “we,” “us,” or “our”) collects, uses, stores, discloses, and safeguards personal information and Protected Health Information (PHI) processed through our medical ambient listening software, applications, APIs, and associated services (collectively, the “Platform” or “Services”).

This policy is specifically tailored to the unique privacy demands of ambient clinical recording, automated clinical documentation, and medical terminology processing.

Table of Contents

1. 1. Scope & HIPAA Compliance
2. 2. Information We Collect & How We Collect It
3. 3. The Ambient Data Lifecycle (Audio Deletion Policy)
4. 4. How We Process Your Information
5. 5. Sharing and Disclosure of Information
6. 6. AI Model Training & Data Safeguards
7. 7. Enterprise Security & Encryption
8. 8. Your Rights and Choices
9. 9. State Privacy Laws
10. 10. Changes to This Policy & Contact Info

1. Scope & HIPAA Compliance

This Privacy Policy applies to licensed healthcare professionals, clinical staff, and enterprise health systems (collectively, “Users” or “Providers”) utilizing the Oncology Solutions LLC ambient scribe platform.

• Business Associate Agreement (BAA) Status: Our Services are designed for use with Protected Health Information (PHI) governed by the Health Insurance Portability and Accountability Act (HIPAA), and we act as a Business Associate of the physicians and practices that use them. Since September 21, 2026, every User must accept our HIPAA Business Associate Agreement after signing in and before using the Platform to process PHI. Each acceptance is recorded with its date and the version accepted, and a new version of the agreement must be accepted before use continues. A summary of the key terms is shown at acceptance; the full agreement is available on request from the contact in Section 10. Our agreements with the infrastructure and AI providers that process PHI for us, and the conditions attached to two of them, are set out in Section 5.
• Patient Identifiers: The Platform does not ask for, and is not designed to hold, a patient’s full name, date of birth, medical record number, or similar formal identifier. Use a de-identified handle such as initials or a private code in the patient-identifier field. This is a data-minimization measure and applies whether or not a BAA is in effect. It does not de-identify an encounter: the audio, transcript, and generated note remain PHI and are handled as described in this policy.
• Precedence: Where a Business Associate Agreement is in effect between us and a User or covered entity, its terms control over this Privacy Policy and our Terms of Use with respect to any Protected Health Information (PHI) covered by that agreement.

2. Information We Collect & How We Collect It

A. User Account & Credential Information (Disclosed by You)

We collect registration and identity verification details to ensure only authorized, licensed professionals access the Platform:

• Professional Credentials: Name, professional credential (for example MD, DO, NP, or PA-C), and National Provider Identifier (NPI).
• Account Credentials: Email address and an optional phone number. The Platform is passwordless — you sign in with a one-time code sent to your email or, if you have registered one, a passkey held on your own device, rather than a stored password. Codes are sent by email only; the phone number is kept with your account and is not currently used to deliver codes. If you register a passkey, we store its public key and identifier so that we can verify it; the private key, and any fingerprint or face data your device uses to unlock it, stay on your device.

B. Ambient Audio & Clinical Consultation Data (Collected in Real-Time)

During patient-provider consultations, when actively initiated by the Provider, the Platform captures:

• Ambient Audio Recordings: Temporary raw audio of the verbal dialogue between the clinician, patient, and any present third parties.
• Encounter Transcripts: Automated text transcripts generated from the captured audio.
• Generated Notes: Structured clinical summaries, SOAP notes, and patient instructions generated by our clinical AI.

C. Automated Operational Logs (Collected Automatically)

To maintain security, track audit logs required by HIPAA, and diagnose technical errors, we automatically record:

• Device Details: IP address, browser type, operating system, hardware model, and unique device identifiers.
• Access Metrics: Timestamps of logins, recording starts/stops, and note-generation activity.

3. The Ambient Data Lifecycle (Audio Deletion Policy)

To limit data exposure and safeguard patient privacy, Oncology Solutions LLC operates on a strict transient storage workflow for all voice and conversational data:

• Raw Audio: Audio is streamed to our transcription provider for processing and is not written to durable storage on our servers at any point — it exists only transiently in memory/temporary files for the duration of that processing request.
• Transcripts, Notes, and Related Data: Once saved, the transcript, generated note, coding, and toxicity data for an encounter are retained for a fixed 24-hour window and then automatically and permanently deleted — this applies uniformly to every encounter and every User; it is not configurable per institution or hospital agreement.

4. How We Process Your Information

Oncology Solutions LLC processes your data strictly for legitimate clinical, administrative, and security purposes:

• Clinical Note Generation: Utilizing advanced machine learning models to synthesize ambient conversations into accurate, structured medical draft notes.
• Credential & Licensing Audits: Validating NPI numbers against national registries to prevent credential fraud or unauthorized clinical access.
• HIPAA Compliance Auditing: Maintaining immutable audit logs of which authorized accounts accessed, modified, or exported clinical data.

5. Sharing and Disclosure of Information

We do not sell, license, or rent patient clinical data or provider information. We only share information under the following strictly controlled circumstances:

• With Infrastructure and AI Vendors: We use third-party providers for hosting, database storage, and AI-based transcription and note generation. As of the Effective Date of this policy, our Business Associate Agreements with them stand as follows:
  • Neon (database): agreement in effect since September 4, 2026.
  • Fly.io (application hosting): agreement in effect since September 15, 2026.
  • Google Cloud (retention of application logs): agreement in effect since September 9, 2026.
  • Anthropic (note generation and other AI-drafted analysis): agreement executed September 28, 2026. It covers requests made from an Anthropic organization configured for HIPAA. Ours is so configured, and we are completing our verification that the Platform’s requests fall within it.
  • OpenAI (transcription of encounter audio, and text embedding): agreement executed September 25, 2026. It covers our use only while a data-retention feature that OpenAI provisions is enabled on our account. OpenAI’s console did not show the feature on October 3, 2026, and showed a changed retention setting on October 7, 2026. OpenAI stated in writing on October 10, 2026 that the feature is enabled wherever its console shows the agreement as accepted, and the console showed that on October 11, 2026. On that basis we treat the condition as met from a date between October 3 and October 7, 2026 that we cannot fix more precisely.
  • Vercel (delivery of the web application’s files), Upstash (rate limiting and caching), and Resend (delivery of sign-in codes by email) are not sent PHI, by design, and we have no Business Associate Agreement with them. Resend does not offer one.

  Each agreement applies from its date and does not cover information processed before it; for OpenAI, that includes information processed before the condition above was met.

• For Legal & Safety Mandates: Where required by federal law, court order, or to defend against legal claims, or to protect the safety and security of patients and clinicians.

6. AI Model Training & Data Safeguards

• AI Providers Used: Transcription and note generation are performed by sending encrypted requests over HTTPS to third-party AI providers (currently OpenAI for transcription and Anthropic for note generation). These are the same providers’ standard API products, not a dedicated private deployment we operate — see Section 5 for the status of our Business Associate Agreements with these providers.
• Model Training: Under these providers’ standard API terms, data submitted through their APIs is not used to train their general-purpose models by default. We do not separately use your clinical inputs to train any model of our own.

7. Enterprise Security & Encryption

We utilize robust administrative, physical, and technical safeguards designed to exceed industry healthcare standards:

• Data in Transit: All audio transmissions, API payloads, and metadata are encrypted in transit via HTTPS/TLS, including HTTP-Strict-Transport-Security (HSTS) so browsers never fall back to an unencrypted connection.
• Data at Rest: Our database provider encrypts all stored data at rest using AES-256.
• Access Control: Sign-in requires either a one-time code sent to your verified email or, if you have registered one, a passkey held on your own device (no password to be phished or reused); a passkey sign-in does not use an emailed code. Sessions automatically time out after a period of inactivity. We do not currently require a second authentication factor in addition to the code or passkey, or offer role-based permission tiers beyond a single administrative role used for internal oversight.

8. Your Rights and Choices

As a licensed clinical user, you maintain control over your data:

• Audio Interruption: You can pause, stop, or delete a live ambient recording at any point during a clinical encounter.
• Access & Edits: You have the right and duty to review, edit, and correct any draft note the Platform generates before relying on it.
• Data Access and Deletion: You can request a full export of everything we hold about your account, or request permanent deletion of your account and all associated data, by contacting us at the email address in Section 10. The Platform does not currently have a screen for doing either yourself; we carry out the export or deletion on your request. Deletion is irreversible and, once processed, removes your encounters, notes, preferences, and account record. Our audit log of access to PHI is kept, with the link to your account removed. PHI we hold on your behalf is also governed by the Business Associate Agreement described in Section 1.

9. State Privacy Laws

Hei Atlas is currently used directly by individual licensed practitioners who sign up themselves, rather than exclusively through institutional or hospital contracts. Whether a particular state consumer privacy law (such as the California Consumer Privacy Act or the Colorado Privacy Act) applies to your use of the Platform, and to what extent, depends on your specific circumstances and jurisdiction. We are not asserting a blanket exemption from state privacy law here, and you should not rely on this policy as legal advice about which laws apply to you. If you have questions about your rights under a specific state law, please contact us using the information in Section 10.

10. Changes to This Policy & Contact Info

We may update this Privacy Policy from time to time to reflect evolving regulatory frameworks or new software capabilities. When changes are made, we will update the “Effective Date” at the top of this document, add the change to the revision history at the end of this section, and, for material changes, notify registered Users by email at the address on their account. A new version of the Business Associate Agreement is presented at sign-in and must be accepted before use continues. The Platform does not currently show policy-change notices inside the provider dashboard.

For compliance audits, questions regarding this policy, or concerns about data processing, please contact us at:

Oncology Solutions LLC
Email: compliance@oncologysolutions.us

To raise a concern without identifying yourself — about privacy, security, conduct or anything else — use the anonymous report form at heiatlas.ai/report. Nothing that identifies the reporter is recorded.

Revision history

• July 15, 2026: This policy was published.
• September 2, 2026: Sections 1 to 9 were rewritten to correct statements that did not match the Platform, including the statement that a Business Associate Agreement was already signed.
• October 6, 2026: The anonymous report form was added to Section 10.
• October 13, 2026: Sections 1, 5, 6, and 8 were updated for the Business Associate Agreements now in effect and the conditions attached to them; Sections 2 and 7 for passkey sign-in and for the account information we actually collect; and Section 10 for how notice of changes is given. Registered Users are notified of this revision by email.

The Effective Date at the top of this document was not changed when the September 2 and October 6, 2026 revisions were published; it read July 15, 2026 until this revision. Our records do not show that Users were notified of those two revisions.