Privacy Policy — HealthSuitePro

PRIVACY POLICY (v2026-07) — SoftIngenious LLC

WHAT WE PROCESS. (a) Account data of Users (name, work email, job title, credentials, signature); (b) PHI entered by Customers, which we process solely as a Business Associate under the executed BAA and never for our own purposes; (c) operational logs (audit trail, security events).

HOW PHI IS PROTECTED. Encryption at rest for PHI fields and signatures; TLS in transit; unique user IDs; role- and module-based access; 15-minute automatic logoff; append-only audit logging of PHI access; SHA-256 integrity hashing of signed records; per-tenant subdomain isolation.

NO SALE, NO ADS. We do not sell personal information or PHI and do not use PHI for advertising or to train AI models. AI subprocessors are contractually barred from training on Customer data.

SUBPROCESSORS. A current list of subprocessors is available from HealthSuitePro on request; each PHI-handling subprocessor operates under a BAA. Customers are notified of additions.

YOUR RIGHTS. Patients exercise HIPAA rights (access, amendment, accounting) through their provider; the platform gives providers one-click export and audit tooling to fulfill them. California residents: we act as a service provider under the CCPA/CPRA and do not sell or share personal information; access/deletion requests route through the Customer. EU/UK data subjects: see the GDPR features described in the product compliance documentation.

RETENTION. PHI is retained per each Customer's configured retention policy and applicable medical-record law; account data is retained for the life of the account plus statutory periods; audit logs are append-only.

BREACH NOTIFICATION. Incidents are handled per the BAA and the platform breach register (HIPAA ≤60 days; UK/EU ≤72 hours where applicable).

CONTACT. privacy@healthsuitepro.com · SoftIngenious LLC.