PRIVACY POLICY

Version 2.1 | Effective Date: July 2026

Atelia Software Inc., doing business as Atelia Health (“Atelia Health,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your Personal Information and Protected Health Information. This Privacy Policy describes the types of information we collect when you visit our website(s), use our mobile application (“App”), interact with us online or through email, participate in our programs or services, or engage in other business interactions with us (collectively, our “Services”). It also explains how we collect, use, share, and protect your information.

This Privacy Policy applies to all users of our Services, including healthcare providers (“Providers”), their staff and authorized representatives, and patients who receive communications through our platform on behalf of their healthcare provider.

2.1 Our Role as a Business Associate

Atelia Health provides healthcare operations, billing, communication, and practice management services to healthcare providers. Under the Health Insurance Portability and Accountability Act of 1996, as amended by the HITECH Act (collectively, “HIPAA”):

• The healthcare provider (“Provider”) who uses our Services is the Covered Entity under HIPAA. The Provider maintains the direct relationship with patients and is responsible for obtaining any required patient authorizations and providing patients with a Notice of Privacy Practices.
• Atelia Health is the Business Associate under HIPAA. We receive, create, maintain, and transmit Protected Health Information (“PHI”) solely on behalf of and at the direction of the Provider.
• Our collection, use, and disclosure of PHI is governed by HIPAA, our Business Associate Agreement with the Provider, and this Privacy Policy.

2.2 Business Associate Agreement

Before any PHI is transmitted to or through Atelia Health, Providers must agree to a Business Associate Agreement (“BAA”) with Atelia Health. The BAA governs the permitted uses and disclosures of PHI and establishes the obligations of both parties under HIPAA.

• Individual Providers: By registering for and using Atelia Health’s Services, the Provider agrees to the Business Associate Agreement incorporated as Exhibit A to our Terms of Service, available at ateliahealth.com/terms.
• Group Practices and Organizations: A designated authorized representative may execute a standalone Business Associate Agreement on behalf of the practice or organization. Individual providers within the practice are added as authorized users under the practice’s account.
• Health Systems and Enterprises: Institutional Business Associate Agreements are available for health systems, hospitals, and large organizations. Contact compliance@ateliahealth.com for enterprise BAA arrangements.

2.3 Information for Patients

If you are a patient receiving communications through Atelia Health (such as text messages, phone calls, or video calls) on behalf of your healthcare provider, please be aware that:

• Your healthcare provider — not Atelia Health — is responsible for the treatment decisions and clinical care you receive.
• Atelia Health acts as a Business Associate to your healthcare provider. We handle your information in accordance with HIPAA and the Business Associate Agreement between Atelia Health and your provider.
• Your provider’s Notice of Privacy Practices governs how your health information may be used and disclosed. We recommend you review your provider’s Notice of Privacy Practices for more information.
• We do not have an independent patient relationship with you. We process your information solely at the direction of your healthcare provider.

3.1 Personal Information

We may collect and process the following categories of Personal Information:

• Identifiers: Names, email addresses, telephone numbers, fax numbers, mailing addresses, Social Security numbers (only when required for specific healthcare operations), medical record numbers, health plan beneficiary numbers, account numbers, and other unique identifiers.
• Professional Information: Resumes, employment history, education, medical credentials, specialty, NPI numbers, facility privileges, and license/certification numbers.
• Internet and Electronic Activity: Information about your interactions with our website, App, emails, and other communications, including IP addresses, browser type, device identifiers, cookies, and usage data.
• Geolocation Data: Approximate location data, including GPS data when you use our mobile App with location services enabled.
• Commercial Information: Purchase history, enrollment in programs, subscription and billing records.
• Audio, Electronic, or Visual Information: Images, audio, and video from consultations, communications, and documents you provide to us.

3.2 Protected Health Information (PHI)

When Providers use our Services, we receive, create, maintain, and transmit Protected Health Information on behalf of the Provider. PHI handled through our platform may include:

• Patient Demographics: Names, dates of birth, gender, addresses, and contact information.
• Clinical Data: Medical record numbers (MRNs), diagnoses, admission and discharge dates, facility and room assignments, vital signs, medication lists, lab results, imaging reports, and clinical notes.
• Insurance and Billing Information: Payer names, policy numbers, group numbers, authorization details, ICD-10 diagnosis codes, and CPT charge codes.
• Census and Scheduling Data: Patient census lists, physician schedules, shift assignments, and facility assignments.
• Documents and Faxes: Clinical documents, referrals, clearance letters, prior authorization correspondence, lab reports, and other documents received via electronic fax (e-fax), upload, email, or other electronic transmission.
• Communication Records: Text messages, call logs, voicemail transcriptions, and video call records between Providers and patients or between Providers and other healthcare entities.

3.3 How We Collect Information

We collect information through the following methods:

• Direct from Providers: When Providers or their staff enter information into our platform, upload documents, or communicate through our Services.
• Mobile App Uploads: When Providers or their staff upload census photos, clinical documents, or other images via our mobile App. Images are processed using AI/OCR technology to extract structured data. Providers are responsible for deleting source images from their personal devices after upload.
• Electronic Fax (E-Fax): When documents are received via Atelia Health’s dedicated e-fax numbers. Inbound faxes are processed by AI to classify document type (e.g., referral, lab result, prior authorization, clearance letter) and extract relevant data.
• Email and Text Forwarding: When Providers or their staff forward documents or information to Atelia Health via email or text message.
• EHR Integration: When authorized by the Provider, we may receive data from electronic health record systems (e.g., Epic, Cerner) via HL7, FHIR, or API interfaces. Data retrieved from EHR systems is used solely to populate the Provider’s records within Atelia Health.
• Patient Communications: When patients respond to text messages, calls, or other communications initiated by the Provider through our platform.
• Automated Collection: When you interact with our website or App, we may automatically collect technical information such as IP addresses, browser type, device identifiers, and usage data through cookies and similar technologies.

4.1 Use of Protected Health Information

We use PHI only as permitted by HIPAA and our Business Associate Agreement with the Provider. Permitted uses include:

• Providing the Services requested by the Provider, including billing, census management, scheduling, clinical documentation, patient communication, care coordination, fax processing, and practice management.
• Treatment, Payment, and Healthcare Operations as defined by HIPAA, when performed on behalf of and at the direction of the Provider.
• As required by law, including for public health activities, health oversight, judicial and administrative proceedings, and law enforcement purposes as permitted by HIPAA.
• De-identification of PHI in accordance with HIPAA’s de-identification standards (Safe Harbor or Expert Determination method), solely for purposes of improving our Services, conducting research, or generating aggregate analytics. De-identified data does not constitute PHI and is not subject to HIPAA restrictions.

We will NOT: sell PHI; use PHI for marketing purposes without Provider authorization; share PHI with third parties except as permitted by the BAA and HIPAA; use PHI for any purpose other than delivering the Services or as required by law; or use PHI to discriminate against any individual.

4.2 Use of Personal Information (Non-PHI)

We may use your Personal Information (that is not PHI) to:

• Communicate with you, including responding to your requests, questions, or inquiries.
• Provide, maintain, and improve our Services and develop new features.
• Process and manage safety and quality concerns.
• Fulfill our contractual obligations to you or conduct business with you.
• Analyze and improve our website, App, and business processes.
• Conduct surveys, obtain feedback, or gather testimonials.
• Comply with legal and regulatory requirements.
• Conduct other legitimate business activities as allowed by applicable law.

5.1 Sharing of PHI

We may disclose PHI only as permitted by HIPAA and our Business Associate Agreement:

• To the Provider (Covered Entity) in connection with the Services we provide.
• To other healthcare providers, health plans, or healthcare clearinghouses as directed by the Provider for Treatment, Payment, or Healthcare Operations.
• To patients and their designated representatives as directed by the Provider through our communication features (text, call, video).
• To our subcontractors and service providers who perform functions on our behalf that involve the use or disclosure of PHI, provided that we have entered into a Business Associate Agreement (or subcontractor BAA) with each such entity.
• As required by law, including for public health, health oversight, judicial proceedings, or law enforcement as permitted by HIPAA.

5.2 Subcontractors and Sub-Business Associates

We engage the following categories of subcontractors who may create, receive, maintain, or transmit PHI on our behalf. All subcontractors handling PHI are bound by Business Associate Agreements with Atelia Health:

• Cloud Infrastructure: Google Cloud Platform (GCP) — SOC 2 and ISO 27001 certified data centers, US-based data residency. All PHI stored and processed on GCP infrastructure.
• Electronic Fax Services: Consensus Cloud Solutions — provides e-fax receiving and transmission services. BAA in place.
• Payment Processing: Stripe — PCI-DSS Level 1 certified. Stripe does not store or process PHI. Payment data is handled as standard financial transactions.

We may engage additional subcontractors from time to time. All subcontractors who handle PHI will be required to enter into a BAA with Atelia Health before receiving any PHI.

5.3 Sharing of Personal Information (Non-PHI)

We may disclose your Personal Information (that is not PHI) to:

• Third parties to whom you authorize us to disclose your information in connection with our Services.
• Authorized law enforcement, regulatory, or government authorities as required by law or pursuant to a valid subpoena or court order.
• Third parties to protect and defend Atelia Health’s rights and interests, such as for corporate audits, investigating complaints, or exercising our legal rights.
• A successor entity in connection with a merger, acquisition, reorganization, or sale of all or substantially all of our assets, provided that the successor agrees to be bound by this Privacy Policy.

We implement administrative, technical, and physical safeguards designed to protect PHI and Personal Information in accordance with the HIPAA Security Rule and industry best practices:

• Encryption: All PHI and sensitive data is encrypted in transit using TLS 1.2+ and at rest using AES-256 encryption via Google Cloud’s native encryption mechanisms managed through Google Cloud Key Management Service (KMS).
• Access Controls: Strict Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC). Multi-Factor Authentication (MFA) required for privileged accounts. All API access protected using secure token-based authentication (JWT) with granular permission scopes.
• Network Security: Production systems containing PHI operate in dedicated, restricted-access network segments with VPC segmentation, firewalls, and intrusion detection (Google Cloud Armor and Cloud IDS).
• Audit Logging: Comprehensive audit trail for all data access, modifications, and user actions. Logs retained securely and monitored with automated alerting for suspicious activity.
• Endpoint Security: All employee devices protected with antivirus and EDR solutions. Device-level encryption (FileVault/BitLocker) required for all team members accessing PHI. PHI is never stored locally on employee devices.
• Vulnerability Management: Automated dependency scanning (Dependabot, SonarQube), continuous cloud security monitoring (Google Cloud Security Command Center), and critical CVE patching within 72 hours of discovery.

Despite our efforts, no information security measures can guarantee absolute security. We encourage you to take steps to protect your own information, such as using strong passwords and not sharing account credentials.

7.1 How Long We Retain Data

We retain data only for as long as it is needed for the purpose it was collected, or for the period required by law. Our retention periods by category are:

• Account and Profile Data: Retained while your account remains active. Following account closure or a verified deletion request, account and profile data is deleted or de-identified within thirty (30) days, except where longer retention is required by law or by the Business Associate Agreement with your organization.
• Protected Health Information: Retained on behalf of, and for the period directed by, the Provider or hospital that is the Covered Entity. HIPAA requires related documentation to be retained for at least six (6) years, and state medical record retention laws may require longer. Atelia Health does not unilaterally delete PHI that the Covered Entity is legally required to keep.
• Communication Records: Text messages, call logs, voicemail transcriptions, and fax records form part of the patient record and follow the retention period applicable to that record.
• Audit and Security Logs: Retained for six (6) years in accordance with the HIPAA Security Rule.
• Backups: Deleted data may persist in encrypted backups for up to thirty-five (35) days, after which it is overwritten on our standard backup rotation.
• De-Identified Data: De-identified data that has been stripped of all HIPAA identifiers in accordance with the Safe Harbor or Expert Determination method may be retained indefinitely for analytics, research, and product improvement purposes.

7.2 How to Request Deletion of Your Data

You may request deletion of your account and associated personal data at any time, free of charge, by either of the following methods:

• Online: Submit a request at ateliahealth.com/delete-my-account and confirm using the link in the email we send to the address on your account.
• By email: Write to privacy@ateliahealth.com from the email address on your account, with the subject “Data Deletion Request”.

We acknowledge deletion requests within five (5) business days and complete verified requests within thirty (30) days. We may need to verify your identity before acting on a request. Deleting your account removes your login credentials, profile, preferences, and device identifiers, and revokes your access to the Services.

Some information cannot be deleted on request. Protected Health Information that forms part of a patient’s medical record belongs to the Covered Entity and is retained under the retention periods described in Section 7.1; the same applies to records we are required to keep for legal, audit, tax, or security purposes. Where we cannot delete data, we will tell you why and continue to protect it under this Privacy Policy.

7.3 Patient Deletion Requests

If you are a patient, your health record is held by your healthcare provider, not by Atelia Health. Please direct requests to access, amend, or delete your health information to your provider’s office. If you contact us directly, we will refer your request to your provider and support them in responding to it.

7.4 Provider and Organization Termination

Upon termination of a Provider’s or organization’s account, we will return or destroy PHI as specified in the Business Associate Agreement, except where retention is required by law or where return or destruction is not feasible, in which case we will continue to protect the information in accordance with the BAA.

In the event of a breach of unsecured PHI, Atelia Health will comply with the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414):

• Provider Notification: Atelia Health will notify the affected Provider within 24 hours of discovery of any confirmed breach or suspected breach involving the Provider’s PHI. Notification will include a description of the breach, the types of PHI involved, the steps taken to investigate and mitigate the breach, and recommendations for steps the Provider should take.
• Individual Notification: The Provider (as the Covered Entity) is responsible for notifying affected individuals in accordance with HIPAA. Atelia Health will cooperate with and support the Provider in fulfilling this obligation.
• HHS Notification: Atelia Health will cooperate with the Provider in reporting breaches to the Secretary of Health and Human Services as required by HIPAA.

Atelia Health maintains a formal Incident Response Plan based on the NIST SP 800-61 framework, with a designated Incident Response Team (IRT) available 24/7.

9.1 Mobile App

Our mobile application allows Providers and their staff to access the Services from mobile devices. When using the App:

• Census photos and document images uploaded through the App are transmitted via encrypted connection (TLS 1.2+) to our servers for processing.
• AI/OCR technology is used to extract structured data (patient names, MRNs, room numbers, admit dates, billing codes) from uploaded images and faxes.
• Providers and their staff are responsible for deleting census photos and any other images containing PHI from their personal devices after uploading to Atelia Health.
• The App may request access to your device’s camera and photo gallery solely for the purpose of capturing or selecting documents for upload. We do not access your device’s camera or photo gallery for any other purpose.

9.2 Electronic Fax (E-Fax)

Atelia Health provides dedicated e-fax numbers for receiving documents from hospitals, referring physicians, insurance companies, and other healthcare entities:

• Inbound faxes are received digitally and processed by AI to classify document type and extract relevant data.
• Classified documents are routed to the appropriate patient chart within the Provider’s account.
• Fax history is maintained as part of the patient’s record within the platform.
• E-fax services are provided through Consensus Cloud Solutions under a Business Associate Agreement.

9.3 AI and Automated Processing

Atelia Health uses artificial intelligence and machine learning technologies to:

• Extract structured data from unstructured documents (OCR/document processing).
• Classify and route inbound faxes and documents.
• Transcribe voicemails and classify inbound calls.
• Assist Providers with billing code suggestions and clinical documentation.

All AI processing of PHI is performed within our HIPAA-compliant infrastructure. AI outputs are presented to Providers for review and confirmation before any clinical or billing actions are taken. Atelia Health does not use PHI to train general-purpose AI models.

We may use cookies and other tracking technologies (such as web beacons, tags, scripts, and device identifiers) to collect and store analytics and other information when you use our website or App. These technologies may provide us with:

• The type of web browser and operating system you use.
• The domain from which you access the Internet.
• The website from which you linked to our website or App.
• The date, time, and pages you visit on our website or App.
• Device identifiers and IP addresses.

We use this information to analyze usage patterns, improve our Services, and personalize your experience. We do not use tracking technologies to collect PHI.

11.1 Provider Rights

As a Provider using our Services, you have the right to:

• Access, correct, or request deletion of your account information and data. See Section 7.2 for how to submit a deletion request.
• Request an accounting of disclosures of PHI made by Atelia Health on your behalf.
• Terminate the Business Associate Agreement and request return or destruction of PHI in accordance with the BAA terms.
• Be notified of any breach of unsecured PHI as described in Section 8.

11.2 Patient Rights

If you are a patient whose healthcare provider uses Atelia Health:

• Your rights to access, amend, and receive an accounting of disclosures of your PHI are governed by HIPAA and should be directed to your healthcare provider.
• Your healthcare provider — not Atelia Health — is responsible for responding to your requests regarding your PHI.
• If you wish to opt out of receiving text messages or other communications sent through Atelia Health on behalf of your provider, please contact your provider’s office directly.

11.3 General Rights

Depending on your jurisdiction, you may have additional rights under applicable state and federal privacy laws, including the right to:

• Know what Personal Information we have collected about you.
• Request correction of inaccurate Personal Information.
• Request deletion of your Personal Information, subject to legal retention requirements, using the methods in Section 7.2.
• Object to or restrict certain processing of your Personal Information.
• Opt out of the sale of your Personal Information. Atelia Health does not sell Personal Information or PHI.

To exercise any of these rights, please contact us at privacy@ateliahealth.com. We may require you to verify your identity before processing your request.

• All PHI and Personal Information is stored in US-based Google Cloud data centers.
• All data residency is restricted to US-based Google Cloud regions.
• Atelia Health does not outsource engineering, support, or operational services offshore. All personnel with access to PHI or production systems are located within the United States.

Our Services are intended for use by healthcare providers and their authorized staff. We do not knowingly collect Personal Information directly from individuals under 18 years of age. PHI of minor patients may be processed through our platform at the direction of the Provider in accordance with HIPAA and applicable state laws governing the privacy of minors’ health information.

Atelia Health may update this Privacy Policy from time to time to reflect changes in our practices, Services, or applicable laws. When we make material changes, we will update the “Effective Date” at the top of this policy and, where required, provide notice to affected users. We encourage you to review this policy periodically.

Atelia Health sends SMS/text messages to patients and users on behalf of the healthcare providers who use our Services — for example, appointment reminders, care and follow-up communications, secure document links, and replies to messages you send. The following terms apply to our text messaging program:

• Consent: You receive text messages from the program only if you opted in to them, through a distinct checkbox that is unchecked by default and that you may decline. Your provider’s use of Atelia Health does not by itself enroll you. Consent is never a condition of purchase, of creating an account, or of receiving care, and declining it does not restrict your access to any part of the Services. A one-time verification code that you request in order to verify your number is sent separately and enrolls you in nothing.
• Message Frequency: Message frequency varies and depends on your interactions with your provider and the Services you use.
• Message and Data Rates: Message and data rates may apply, according to your mobile carrier plan.
• Opt-Out: You can opt out at any time by replying STOP to any text message. After you reply STOP, we will send a confirmation message and will not send further texts unless you opt back in. You may also contact your provider’s office directly to stop communications.
• Help: Reply HELP to any message, or email privacy@ateliahealth.com, for assistance.
• No Sharing of Mobile Information: We do not sell or share mobile phone numbers, text-messaging opt-in consent, or SMS program data with third parties or affiliates for their own marketing or promotional purposes. Mobile information is used solely to deliver the communications described above on behalf of your provider and to operate the Services, and is disclosed only to the subprocessors that help us deliver those messages (such as our telecommunications provider) under contractual confidentiality and HIPAA obligations.

If you have questions, concerns, or requests related to this Privacy Policy, your Personal Information, or our HIPAA compliance practices, please contact us:

Atelia Software Inc. (dba Atelia Health)
Privacy Officer
Email: privacy@ateliahealth.com
Phone: (415) 505-6124
Website: ateliahealth.com

For HIPAA compliance inquiries or to report a potential breach, contact: compliance@ateliahealth.com