Privacy Policy

1.1 Information You Provide

• Account & Profile Data: Name, email, phone number, organization, specialty, NPI (if applicable), and similar details supplied when you register, join our waitlist, or configure your practice settings.
• Communications: Content of messages you send to us, including support tickets, feedback, and feature requests.
• Clinical Inputs (including PHI): Voice dictations, typed encounter notes, patient demographics, diagnoses, treatment plans, orders, and other clinical content you submit through Kevin.
• Audio Recordings: When you use voice dictation features, we temporarily process audio to generate transcripts. Raw audio is deleted immediately after transcription unless you explicitly opt in to extended storage.
• Patient-Submitted Images (PHI): Clinical images submitted via MMS by patients at their healthcare provider's request, such as wound photos, skin condition images, insurance cards, and intake documents.
• Payment Information: Billing address and payment method details (processed securely through third-party payment processors).

1.2 Information Collected Automatically

• Device & Usage Data: IP address, device identifiers, browser type, operating system, app version, pages viewed, referring URLs, session duration, and timestamps.
• Diagnostic & Analytics Data: Crash logs, performance metrics, feature usage patterns, and interaction events. This data is collected in a manner that does not include PHI.
• Audit Logs: Records of who accessed what data and when, maintained for security monitoring and HIPAA compliance.
• Location Data: General geographic location derived from IP address (not precise GPS location).

1.3 Information from Third Parties

When you enable integrations (e.g., EHR systems, practice management software, calendar services) we receive the limited profile, token, or clinical data required to provide the integrated functionality. Each integration requires your explicit consent.

2.1 Core Service Delivery

• AI-Powered Clinical Workflows: Process your voice dictations and clinical inputs through our AI models to draft encounter notes, orders, patient education materials, and related workflow artifacts for clinician review.
• Personalization: Learn your documentation preferences, templates, and specialty-specific terminology to improve accuracy over time.
• Integration Fulfillment: Transmit generated documentation to connected EHR systems or other platforms you authorize.

2.2 Operations & Improvement

• Deliver waitlist confirmations, product updates, SMS/text notifications, and transactional notices.
• Analyze de-identified, aggregated usage metrics to improve features, reliability, and AI accuracy.
• Detect, investigate, and prevent security incidents, fraud, or misuse.
• Maintain audit trails for HIPAA compliance and quality assurance.

3.1 How Kevin Processes Your Data

Kevin! uses artificial intelligence — current Google Gemini and OpenAI GPT models — to transcribe dictations, structure clinical notes, draft orders, and create patient-friendly summaries and related workflow artifacts. We have signed Business Associate Agreements with Google and OpenAI for this processing. Your clinical inputs are processed in real time to deliver these features.

3.3 Third-Party AI Services

We use third-party AI infrastructure providers and model providers, including Google and OpenAI, as subprocessors to power certain features. We maintain signed BAAs with those AI providers. All subprocessors are contractually bound to:

• Process data only as instructed by us for service delivery
• Not use your data for their own model training
• Not sell PHI, clinical inputs, or other confidential information
• Maintain security standards equivalent to our own
• Enter into Business Associate Agreements where required
• Delete data upon termination of services

3.4 AI Data Handling Summary

3.5 Audio Recording Retention

When you use voice dictation features, audio is processed in real-time to generate transcripts. Raw audio recordings are deleted immediately after transcription and are not retained unless you explicitly opt in to extended storage.

6.1 Our Role Under HIPAA

When healthcare providers (Covered Entities) use Kevin! to process PHI, Rushin InTegrations acts as a Business Associate under HIPAA. We implement administrative, physical, and technical safeguards required by the HIPAA Security Rule.

6.2 Business Associate Agreements

Before you transmit PHI through the Services, we require a signed Business Associate Agreement (BAA) that defines our respective responsibilities for protecting patient information. We also maintain signed BAAs with Google and OpenAI for AI model processing, requiring confidential handling and prohibiting use of PHI or clinical inputs for model training or sale. To request a BAA, contact legal@rushin.ai.

6.3 Minimum Necessary Standard

We access and use only the minimum PHI necessary to provide the Services you request. Our workforce members receive HIPAA training and are bound by confidentiality obligations.

6.4 Subcontractors

All subcontractors and service providers who may access PHI are required to enter into BAAs with Rushin InTegrations, keep information confidential, implement appropriate security safeguards, avoid model-training or sale uses, and report any security incidents promptly.

General Privacy Rights

Depending on your jurisdiction, you may have rights to:

• Access, correct, or delete your personal information
• Object to or restrict certain processing activities
• Receive a copy of your data in a portable format
• Opt out of marketing communications
• Withdraw consent for processing based on consent

HIPAA Rights (For Patients)

If you are a patient whose information is processed through our Services, your HIPAA rights are exercised through your healthcare provider (the Covered Entity), not directly through Rushin InTegrations.

How to Submit Requests

Submit privacy requests to privacy@rushin.ai or through the privacy settings within the App. We will verify your identity before fulfilling requests and respond within applicable legal timeframes (typically 30-45 days).

International Data Transfers

Rushin InTegrations operates in the United States. If you access the Services from another jurisdiction, your information may be transferred to, stored in, or processed in the U.S. We use approved safeguards such as Standard Contractual Clauses when required.

Children's Privacy

The Services are designed for healthcare professionals and are not directed to individuals under 18. We do not knowingly collect personal information from minors. If we learn that we have collected personal information from a child under 18, we will promptly delete that information.

Do Not Track Signals

Our Services do not currently respond to “Do Not Track” browser signals. However, you can manage tracking through your browser's cookie settings.

Changes to This Policy

We may update this Privacy Policy to reflect operational, legal, or regulatory changes. For material updates, we will provide at least 30 days' notice before new terms take effect. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.