Privacy Policy

Introduction

Circle Innovation Lab, Inc. (“Company” or “We”) provides certain services (the “Services”) to physicians, medical practices, and other healthcare providers (“Customers” or “Covered Entities”). The Services are intended for use by healthcare providers and their authorized personnel only.

This Privacy Policy describes how the Company collects, uses, maintains, protects, and discloses information in connection with our website circlehealth.co (the “Website”) and the Services. This Privacy Policy applies to information we collect on this Website, in electronic communications between you and the Company, and through our provision of the Services, including our electronic medical record (EMR) system, chart uploads, audio uploads, audio recordings, and related tools.

This Privacy Policy does not apply to information collected by any third party, including through any application or content that may link to or be accessible from the Website.

Our Role as a Business Associate

The Company operates as a Business Associate under the Health Insurance Portability and Accountability Act (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act (“HITECH”). In this capacity, the Company processes protected health information (“PHI”) and other personal information on behalf of and at the direction of Covered Entities pursuant to Business Associate Agreements (“BAAs”).

Certain of the Company’s Customers are programs subject to the federal regulations governing the Confidentiality of Substance Use Disorder Patient Records 42 CFR Part 2 (“Part 2”). Where the Company receives records from or on behalf of a Part 2 program, it acts as a qualified service organization (“QSO”) under a written Qualified Service Organization Agreement (“QSOA”) that satisfies 42 CFR Section 2.11. Under each such written agreement, the Company acknowledges that it is fully bound by Part 2 with respect to those records and agrees that, if necessary, it will resist any judicial proceedings any efforts to obtain access to patient identifying information except as expressly permitted by Part 2.

Part 2 imposes restrictions that are, in several respects, more stringent than those imposed by HIPAA particularly with respect to disclosures in response to subpoenas and other legal process, and with respect to the use of records in proceedings against a patient. Certain Part 2 obligations, including the records security requirements of 42 CFR Section 2.16 apply to the Company directly as a lawful holder of patient identifying information, independent of any contract. Where Part 2 applies, the Company complies with Part 2 in addition to, and where more restrictive than, HIPAA.

The Company does not maintain a direct treatment relationship with patients. All patient data processed by the Company is received from, and governed by the agreements with, the applicable Covered Entity or Part 2 program. When we act as a Business Associate or QSO, we may be subject to HIPAA and Part 2 rules that govern our use and disclosure of PHI and Part 2 records and that may be more restrictive than otherwise provided in this Privacy Policy.

Customer Responsibilities

Our Customers are responsible for maintaining their own privacy policies and, where applicable, patient notices required by 42 CFR Section 2.22 governing the collection, use, and disclosure of personal information, and for obtaining the necessary authorizations and consents from patients before any personal information or PHI, or Part 2 record, is made available to the Company for use in accordance with this Privacy Policy and the applicable BAA and QSOA.

Customers that are Part 2 programs are responsible for ensuring that patient consents obtained under 42 CFR Section 2.31 are sufficient in scope to authorize the activities the Company performs, and that the Company’s role is consistent with the notice provided to patients under Section 2.22.

Conflict Between This Policy and a BAA or QSOA

In the event of a conflict between this Privacy Policy and the terms of a Business Associate Agreement or Qualified Service Organization Agreement with a Customer, the Business Associate Agreement or Qualified Service Organization Agreement will control with respect to the PHI or Part 2 records governed by that agreement.

Nothing in this Privacy Policy, and no agreement between the Company and a Customer, operates to reduce the protection afforded to records by 42 CFR Part 2. Where Part 2 applies, it controls as a matter of law regardless of the terms of any contract or of this Policy.

Processing of Customer Data

As a service provider to our Customers, the Company collects and processes data related to our Customers and their patients on the Customers’ behalf. In this role, the Company processes data upon instruction from the Customer, consistent with our service agreement and BAA and, where applicable, QSOA with that Customer.

Some of the personal information received by the Company in connection with the Services is provided by healthcare providers that are subject to HIPAA, Part 2, or both. When we receive PHI or Part 2 records, we do so as a Business Associate or QSO under an agreement that, among other things, prohibits us from using or disclosing the PHI or Part 2 records in ways that are not permissible by the Covered Entity or Part 2 program itself, and requires us to implement measures to safeguard the confidentiality, integrity, and availability of the PHI and Part 2 records.

The Company does not use PHI or Part 2 records for its own independent purposes, including marketing, sale of data, or training of AI models using identifiable patient data. The Company does not sell PHI or Part 2 records as that term is defined under any applicable law.

Information We Collect

Information Received from Customers (Covered Entities)

In connection with providing the Services, we receive and process the following categories of information from Covered Entities and Part 2 programs under BAAs and QSOAs:

• Patient demographic information, including name, date of birth, age, address, and contact information.
• Clinical and health information, including medical history, history and physical examination records, mental health exams and assessments, therapy encounters and progress notes, treatment plans, diagnoses, psychosocial information, behavioral observations, and related health data.
• Audio recordings, transcripts, and clinical documentation generated through the Services.
• Other information as directed by the Covered Entity in connection with the Services.

Information received from a Part 2 program constitutes a Part 2 record in the Company’s hands, whether or not it contains substance use disorder treatment content. Information that would identify an individual as a patient of a Part 2 program, including identifier paired with the identity of a Part 2 program Customer, is patient identifying information and is handled accordingly.

This information may include data concerning individuals of all ages, including minors. The Covered Entity or Part 2 program is responsible for obtaining any required authorizations and consents prior to making such information available to the Company.

Information Collected from Service Users

We collect the following information from Customer personnel and other authorized users of the Services:

• Contact and registration information, such as name, email address, and telephone number.
• Account credentials and authentication information.
• Records and copies of correspondence with the Company.
• Transaction and billing information related to the Services.

Information Collected from Prospective Customers

We collect names, email addresses, and other business contact information about individuals whom we consider to be prospective Customers or business partners. We may use third-party service providers to collect, store, and process this information in order to contact prospective Customers about our Services. This information is used and disclosed in the same manner as other personal information described in this Privacy Policy.

Information Collected Automatically

As you navigate the Website or use the Services, we may automatically collect certain technical information, including:

• IP address, browser type, operating system, referring URL, pages visited, and timestamps.
• Device identifiers and information about your internet connection.
• Usage data, including features accessed and actions taken within the Services.
• Audit logs recording which authorized users have accessed patient data and any changes made to such data. We maintain these logs to comply with legal obligations, support HIPAA and Part 2 accountability requirements, and improve the Services.

We collect this information through server logs, cookies, and analytics tools. The Company designs its telemetry, logging and analytics systems so that patient identifying information is not transmitted to third-party monitoring or analytics providers. You may refuse to accept cookies by adjusting your browser settings, though doing so may affect your ability to use certain features of the Website.

We do not engage in behavioral tracking or interest-based advertising. At this time, the Services do not respond to “Do Not Track” signals or similar mechanisms.

How We Use Information

The Company uses the information described above for the following purposes:

• Providing the Services to Customers, including AI-powered transcription, clinical documentation, chart generation, and EMR integration.
• Processing PHI and Part 2 records on behalf of and at the direction of Covered Entities and Part 2 programs as permitted by the applicable BAA and QSOA.
• Performing compliance checks and reducing claim denials for Customers.
• Operating, maintaining, and improving the Website and the Services.
• Communicating with Customer personnel regarding the Services, including technical notices, updates, and support.
• Fulfilling our contractual obligations and enforcing our rights arising from agreements with Customers.
• Complying with applicable legal obligations.
• Investigating and preventing fraudulent transactions, unauthorized access to the Services, and other illegal activities.

For PHI processed on behalf of Covered Entities, our use is limited to the purposes permitted under HIPAA and the applicable BAA. For Part 2 records, our use is limited to what is necessary to provide the contracted services to the Part 2 program, consistent with 42 CFR Section 2.12(c)(4) and 2.13(a). The Company does not use Part 2 records for its own purposes.

Service Providers and Sub-Processors

We engage third-party service providers to perform functions and provide services on our behalf. These service providers may have access to personal information only as necessary to perform their functions and are bound by contractual obligations to maintain confidentiality.

Categories of service providers include:

• Cloud hosting and infrastructure providers.
• Analytics and performance monitoring services.
• Authentication and security services.
• Logging and error tracking services.
• Payment processing services.

Service providers in the categories of analytics, performance monitoring, logging and error tracking do not receive patient identifying information. Identifiers are removed before telemetry is transmitted to those providers.

Where service providers process PHI on our behalf, we maintain Business Associate Agreements with those sub-processors as required by the HIPAA Omnibus Rule. Where service providers process Part 2 records on our behalf, we additionally maintain written agreements containing the acknowledgements required by 42 CFR Section 2.11 that the subprocessor is fully bound by Part 2 with respect to those records and will, if necessary, resist in judicial proceedings any efforts to obtain access to patient identifying information except as Part 2 permits. No subprocessor receives Part 2 records unless both agreements are in place, and each such agreement requires the subprocessor to notify the Company immediately upon receipt of any subpoena, court order, warrant or other legal demand, before responding. We do not authorize our service providers to use or disclose personal information except as necessary to perform services on our behalf or to comply with legal requirements.

Subprocessors are prohibited from using PHI or Part 2 records to train, fine-tune, or improve their own models or services, and from attempting to re-identify any de-identified information.

Disclosure of Information

The Company is not in the business of selling personal information. We may disclose personal information in the following circumstances:

• To service providers and sub-processors as described above.
• To Customers (Covered Entities and Part 2 programs) in connection with the Services.
• To business partners for compliance and claim processing purposes, subject to BAAs and QSOAs where applicable.
• To comply with a court order, law, or legal process, including in response to a government or regulatory request, subject to the limitations described under “Legal Process” below.
• To comply with a court order, law, or legal process, including in response to a government or regulatory request.
• To enforce our agreements, including for billing and collection purposes.
• Where we believe disclosure is necessary to protect the rights, property, or safety of the Company, our Customers, or others.

We may disclose aggregated or de-identified information that does not identify any individual without restriction. Information derived from Part 2 records is treated as de-identified only where de-identification has been performed in accordance with 45 CFR Section 164.514 under express contractual authorization from the applicable Customer, and where the Company retains no means of re-identification.

For PHI processed on behalf of Covered Entities, disclosure is limited to what is permitted under HIPAA and the applicable BAA. For Part 2 records, disclosure is limited to what is permitted under 42 CFR Part 2 and the applicable QSOA.

All personal information is stored and processed in the United States.

Legal Process

The Company’s response to subpoenas, court orders, and other legal demands differs depending on whether the information is sought is a Part 2 record.

For Part 2 records and patient identifying information, the Company will not disclose information, or provide testimony concerning it, in response to a subpoena, warrant, discovery request, or similar demand standing alone. Disclosure requires a court order issued under Subpart E of 42 CFR Part 2 accompanied by a subpoena or other compulsory process, as required by 42 CFR Section 2.12(d)(1). Consistent with 42 CFR Section 2.11 and our agreements with Customers, the Company will, if necessary, resist in judicial proceedings any efforts to obtain access to patient identifying information except as expressly permitted by Part 2.

The Company will not disclose Part 2 records for use in any civil, criminal, administrative, or legislative proceeding against a patient absent the patient’s written consent or a court order meeting the requirements of 42 CFR Section 2.64 or 2.65.

Where the Company receives legal process seeking records originating from a Customer, the Company will notify that Customer promptly and before responding, except where prohibited by law.

Unsolicited Information

This Privacy Policy does not apply to any unsolicited information you provide to the Company through the Services or through any other means. This includes, but is not limited to, ideas for new products or modifications to existing products, feedback, and other unsolicited submissions (collectively, “Unsolicited Information”). All Unsolicited Information shall be deemed to be non-confidential and the Company shall be free to reproduce, use, disclose, and distribute such Unsolicited Information without limitation or attribution. Nothing in this section limits the Company’s obligations with respect to PHI received under a BAA or Part 2 records received under a QSOA.

Children

The Company does not knowingly collect personal information directly from children under the age of 13 through the Website. The Website and Services are intended for use by healthcare providers and their authorized personnel, not by patients or members of the public.

To the extent the Company processes health information about minors (individuals under eighteen (18) years of age), it does so solely as a Business Associate or QSO acting on behalf of Covered Entities and Part 2 programs. The Covered Entity or Part 2 program is responsible for obtaining any required parental or guardian consent under applicable law, including the Children’s Online Privacy Protection Act (“COPPA”) and HIPAA, before making such information available to the Company.

Where a minor patient has consented independently to substance use disorder treatment under applicable state law, 42 CFR Section 2.14 provides that only the minor patient may consent to disclosure of the resulting records, and consent of a parent or guardian is neither required nor sufficient. The Company defers to the Part 2 program’s determination of who holds consent authority in these circumstances and does not disclose records to a parent or guardian on the basis of parental status alone.

Links to Other Websites

The Website may contain links to other websites not operated or controlled by the Company. This Privacy Policy applies only to the Website and the Services and does not apply to any third-party websites. The inclusion of a link on the Website does not imply endorsement of the linked site by the Company. We encourage you to review the privacy policies of any third-party websites you visit.

Data Security

The Company takes reasonable steps to protect personal information, PHI, and Part 2 records from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. We maintain administrative, technical, and physical safeguards, including:

• Encryption of data in transit and at rest.
• Role-based access controls and the principle of least privilege.
• Data isolation measures to ensure one Customer’s patient data is not accessible by another.
• Test environments designed to avoid the use of production personal information. Production patient data is not used in test, development, demonstration or evaluation environments.
• Formal written policies and procedures governing the security of Part 2 records, including access controls, transmission security, and destruction, as required by 42 CFR Section 2.16.

We require our service providers to maintain comparable safeguards.

AI-Specific Safeguards

The Company does not use identifiable patient data to train, fine-tune, or otherwise develop AI models, whether that data is identifiable or de-identified. Audio recordings and transcripts are processed in accordance with the applicable BAA and QSOA and are subject to the same security controls as all other PHI and Part 2 records.

Where the Company creates de-identified information from patient data for its own internal purposes, including quality evaluation and testing of the Services, it does so only where expressly authorized by the applicable BAA under 45 CFR Section 164.504(e)(2)(i)(B) and by the applicable QSOA, and de-identification is performed before the information is used or stored for that purpose. The Company does not attempt to re-identify de-identified information.

The safety and security of information also depends on our Customers. Where we have provided access credentials, Customers and their authorized personnel are responsible for maintaining the confidentiality of those credentials.

No method of transmission over the internet or electronic storage is completely secure. While we implement commercially reasonable safeguards, we cannot guarantee absolute security. Customers and their authorized personnel are encouraged not to transmit PHI to the Company via unencrypted email unless prior arrangements have been made to ensure that the transmission is encrypted.

Terms of Use

Your access to and use of the Website and the Services is also subject to the Company’s Terms of Use https://circlehealth.co/terms-of-use.

Data Retention

We retain personal information as long as necessary to fulfill the purposes described in this Privacy Policy, comply with our legal obligations, resolve disputes, and enforce our agreements.

For PHI processed on behalf of Covered Entities, retention and disposition are governed by the applicable BAA. For Part 2 records, retention and disposition are governed by the applicable QSOA and by 42 CFR Section 2.16. Upon termination of a BAA or QSOA, the Company will return or destroy PHI and Part 2 records as required by the agreement, except to the extent retention is required by applicable law.

All retained personal information and PHI, and Part 2 records remains subject to the terms of this Privacy Policy and, where applicable, the governing BAA or QSOA.

Breach Notification

In the event of a breach of unsecured PHI or of Part 2 records, the Company will notify the affected Covered Entity or Part 2 program without unreasonable delay and in accordance with the HIPAA Breach Notification Rule and the applicable BAA or QSOA. The Covered Entity or Part 2 program is responsible for providing notification to affected individuals and to the Secretary of the U.S. Department of Health and Human Services as required by HIPAA and Part 2.

Prohibition on Redisclosure of Part 2 Records

Records disclosed by the Company that originate from a Part 2 program are accompanied by the notice required under 42 CFR Section 2.32. Federal law prohibits any recipient of such records from making any further disclosure that is not expressly permitted by the prior written consent of the individual whose information is being disclosed, or as otherwise permitted by 42 CFR Part 2. A general authorization for the release of medical or other information is not sufficient for this purpose. Federal law restricts any use of the information to investigate or prosecute with regard to a crime any patient with a substance use disorder, except as provided at 42 CFR Section 2.12(c)(5) and 2.65.

Accessing and Correcting Information

For Patients

If you are a patient of a Covered Entity or Part 2 program for whom the Company provides Services, your rights under HIPAA and 42 CFR Part 2 to access, amend, and receive an accounting of disclosures of your PHI or Part 2 records must be exercised through that Covered Entity or Part 2 program. The Company supports Covered Entities and Part 2 programs in fulfilling such requests in its capacity as a Business Associate or QSO. In the event there is a conflict between this Privacy Policy and the applicable BAA or QSOA regarding the handling of such requests, the BAA or QSOA will control.

Patients who believe their privacy rights under Part 2 have been violated may file a complaint with the Substance Abuse and Mental Health Services Administration or with the U.S. Department of Health and Human Services’ Office for Civil Rights, in addition to contacting the Part 2 program directly.

For Service Users

Customer personnel and other authorized users of the Services may contact us at support@circlehealth.co to request access to, correction of, or deletion of personal information they have provided to the Company, subject to applicable legal, regulatory, and contractual retention requirements.

Notice to California Residents

This section provides additional disclosures required under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”).

HIPAA Exemption

Protected health information that the Company collects, receives, maintains, or transmits as a Business Associate on behalf of Covered Entities is exempt from the CCPA pursuant to California Civil Code Section 1798.145(c)(1). This section applies only to personal information that is not PHI, including information collected from Customer personnel, Website visitors, prospective customers, employees, and other individuals whose personal information is not governed by HIPAA. Medical information governed by the Confidentiality of Medical Information Act, and information whose collection, use or disclosure is otherwise governed by federal law including 42 CFR Part 2, is likewise outside the scope of this section to the extent provided by Section 1798.145(c).

Sale and Sharing of Personal Information

We do not sell personal information as that term is defined under the CCPA. We do not share personal information for cross-context behavioral advertising purposes.

Sensitive Personal Information

We use and disclose sensitive personal information (as that term is defined under the CCPA) only for purposes permitted under CCPA Section 1798.121, including to provide the services requested and to fulfill our employment-related obligations.

Your California Privacy Rights

If you are a California resident whose personal information is not exempt as PHI or as information governed by federal law under Section 1798.145(c)(1), you have the following rights:

• Right to Know. Request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, our business or commercial purpose for collecting the information, and the categories of third parties with whom we share it.
• Right to Delete. Request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Correct. Request that we correct inaccurate personal information that we maintain about you.
• Right to Opt-Out of Sale or Sharing. This right is not applicable as we do not sell or share personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information. Direct us to limit our use and disclosure of your sensitive personal information to uses that are necessary to perform the services or as otherwise permitted by law.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA rights.

How to Submit a Request

You may submit a request to exercise your California privacy rights by contacting us at:

Email: support@circlehealth.co

Mail: 500 7th Ave, New York, NY 10018

We will verify your identity before processing your request. If you submit a request on behalf of another person as an authorized agent, we may require proof that you have been authorized to act on their behalf.

We will respond to verifiable consumer requests within forty-five (45) days of receipt. If we require more time (up to an additional forty-five (45) days), we will inform you of the reason and extension period in writing.

We do not disclose personal information to third parties for their direct marketing purposes.

Changes to This Privacy Policy

The Company reserves the right to update or modify this Privacy Policy at any time. We will post any changes on this page and update the “Last modified” date at the top. If we make material changes to how we treat personal information, we will notify affected Customers through reasonable means. Your continued use of the Website or Services after changes are posted constitutes acceptance of the revised Privacy Policy. Changes to this Privacy Policy do not alter the Company’s obligations under any BAA, QSOA, HIPAA or 42 CFR Part 2.

Contact Information

To ask questions or comment about this Privacy Policy and our privacy practices, contact us at:

Email: support@circlehealth.co

Mail: 500 7th Ave, New York, NY 10018