Privacy policy

Last updated: [date] · Template, not in force

This policy explains what information [Company legal name] (“Tidemend”) collects through the Tidemend website and application, how it’s used and the choices you have. Client information that clinicians enter is also governed by any Business Associate Agreement between the clinician and Tidemend.

Information we collect

Account information: your name, email address, professional details you choose to add, and a hashed version of your password.
Clinical content you enter: client records, session recordings, transcripts, dictation, notes, treatment plans and letters.
Preferences: note format, modality, voice, length and whether to keep recordings.
Activity records: an audit log of access to clinical records, sign-ins and exports, including actions taken by clients in the portal.
Practice records: appointments, form answers and signatures, secure messages, invoices, insurance policy details and claims.
Client portal accounts: a client’s email address, a hashed password and their reminder preferences, including a phone number if they choose text reminders.
Payment references: amounts, payment methods and processor references. Card numbers are entered on Stripe’s checkout page and are not received or stored by Tidemend.
Video calls: connection messages used to set up a call, kept for [retention period]. Audio and video travel directly between the two browsers and are not stored unless the clinician records the session.

How we use it

To provide the Service: transcribing audio, drafting documentation and storing your records.
To keep the Service secure, including audit logging and investigating misuse.
To communicate with you about your account and important changes.

We do not sell personal information, and we do not use clinical content for advertising.

Service providers

Depending on configuration, information may be processed by hosting, transcription and AI model providers, email and text-message providers, a payment processor (Stripe), an insurance clearinghouse and a video relay (TURN) server to deliver the Service. A list of these providers will be published at [subprocessor list location]. Each provider handling protected health information must be covered by an appropriate Business Associate Agreement. Whether clinical content may be used to train AI models: [to be confirmed for each provider before launch].

Retention

Session recordings are deleted after the note is generated, unless you choose to keep them.
Reminder and notification records in the outbox are kept for [retention period].
Notes, transcripts, plans and other records are kept until you delete them or close your account.
Audit log entries are kept for [retention period].
After account closure, data is deleted within [period], except where we’re required to keep it by law.

Security

We use safeguards including an audit log, default deletion of recordings, encryption in transit in production deployments, hashed passwords and per-account access controls. No system is perfectly secure. See the security overview for details.

Cookies

The application uses essential, HTTP-only session cookies to keep clinicians and portal clients signed in; the two use separate cookies. [Describe any analytics or other cookies before launch, and how to opt out.]

Your choices and rights

Export your data at any time from Settings.
Correct your account details, or ask us to delete your account.
[Describe region-specific rights, such as access, deletion and objection, and how to exercise them.]

Clients of clinicians

If you’re a client whose clinician uses Tidemend, your clinician controls your records. You may have your own portal login, which lets you see your appointments, forms, messages and invoices and change your reminder preferences. For anything else, including access to or changes in your clinical records, please contact your clinician directly; we will support them in responding.

Changes and contact

We will post updates here and notify account holders of material changes. Questions: [privacy contact email], [postal address].