This privacy policy explains how Compound Care ("Compound Care," "we," "us," or "our") collects, uses, discloses, and protects personal information, and the choices and rights you have. Please read it together with our terms of service.
1. Who we are and what this policy covers
Compound Care provides care management technology and services to primary care clinics, including for Medicare's Advanced Primary Care Management program: check-in calls to patients between visits, care plans, a patient portal, and the records clinics need for billing review. We work on behalf of the clinics we serve ("Clinics"). Compound Care is not a health care provider.
This policy applies to:
- our website, compoundcare.co, and its forms (the "Website"); and
- the Compound Care patient portal and its sign-in codes, and the calls and texts we send for Clinics (together with the Website, the "Services").
It does not apply to information a Clinic collects on its own, or to websites and services run by others that we link to.
2. Health information and HIPAA
When we provide Services to a Clinic, we act as the Clinic's "business associate" under the Health Insurance Portability and Accountability Act of 1996 and its regulations ("HIPAA"). Health information we receive from or create for a Clinic is "protected health information" and is part of the Clinic's records. We use and disclose it only as our business associate agreement with the Clinic and HIPAA allow: to provide the Services to the Clinic, for the Clinic's treatment, payment, and health care operations, and as required by law.
Your Clinic's notice of privacy practices describes how your health information may be used and shared and your rights, including the rights to see and get a copy of your records, to ask for corrections, and to get an accounting of certain disclosures. To use those rights, contact your Clinic. If you contact us instead, we will pass your request to your Clinic.
Where this policy differs from HIPAA or from our agreement with a Clinic about protected health information, HIPAA and that agreement control.
3. Information we collect
Information you give us
- Demo and contact requests: your name, work email, practice name, role, and, if you choose, phone number, and anything you write to us.
- Patient portal sign-in: the patient's name and date of birth, and a caregiver's own name, which we check against the Clinic's records. We do not ask you to enter a phone number; sign-in codes go only to the number the Clinic has on file.
- Portal messages: messages you send your care team and anything you include in them.
- Calls: what you say on a check-in call or a call to a Clinic's care line, which may be recorded and transcribed (see section 6).
Information from Clinics
To provide the Services, Clinics give us information from their records, such as name, date of birth, contact details, conditions, medicines, visits, insurance coverage, and care team. We may also check Medicare eligibility for a Clinic through an eligibility service. This information is protected health information (section 2).
Information collected automatically
- Usage and device information: pages viewed, links clicked, referring site, browser and device type, approximate location derived from IP address, and the dates and times of visits.
- Security information: for the patient portal and staff tools, sign-in times, IP address, and browser, to keep accounts secure and to keep the audit records HIPAA requires.
4. How we use information
We use personal information to:
- provide the Services to Clinics, and to patients and caregivers on their behalf;
- sign you in to the patient portal and verify who is calling a care line;
- deliver your messages to your care team and send your requests to your Clinic;
- send the sign-in codes you ask for, by text or phone call;
- respond to demo requests and questions, and schedule meetings;
- check the quality and safety of our calls and automated assistants, including by testing them with made-up (synthetic) patients;
- keep the Services secure, detect and prevent fraud and misuse, and fix problems;
- improve the Website and the Services; and
- meet legal, regulatory, and contractual obligations, and enforce our terms.
We do not use protected health information for marketing, and we do not use it to train artificial intelligence models for anyone else.
5. How we disclose information
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only:
- To your Clinic: information about a patient goes to that patient's Clinic, for their care.
- To service providers: companies that provide services to us under contracts that limit their use of the information, including business associate agreements where health information is involved. They include cloud hosting and security (Amazon Web Services); text and voice delivery; voice call and speech services; artificial intelligence services that run our automated assistants and draft documents for Clinic review; Medicare eligibility services; electronic health record connections the Clinic chooses; website hosting and analytics; and scheduling (Cal.com).
- For legal reasons: when we believe in good faith the law requires it, to respond to valid legal process, or to protect the safety, rights, or property of any person.
- In a business transfer: as part of a merger, acquisition, financing, or sale of assets, subject to this policy and to our obligations to Clinics.
- At your direction or with your consent: for example, to a caregiver the patient and Clinic have allowed.
6. Calls, recordings, and text messages
Check-in calls are placed for your Clinic by an automated assistant, which tells you so if you ask. Calls may be recorded and transcribed for your care record and for quality review, with a notice at the start of the call where the law requires one. If you object to recording, tell the assistant: the call then continues unrecorded or ends.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. The service providers that deliver our texts and calls use your number only to deliver them. Our text message program is described in our terms of service. Reply STOP to any text to stop texts.
8. How long we keep information
We keep personal information only as long as we need it for the purposes in this policy. We keep protected health information as our agreements with Clinics and the law require (federal and state rules often require care and billing records for six years or more), then return or destroy it. We keep demo request information while we have a business relationship or until you ask us to delete it, and security logs as long as needed to protect the Services and meet audit requirements.
9. How we protect information
We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, separation of each Clinic's records in our systems, access limited to the people who need it, multi-factor authentication for staff, and logs of who accesses patient records. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your information, we will notify you and your Clinic as the law requires.
10. Your choices
- Texts: reply STOP to stop texts. You can still sign in by phone call or with a code from your Clinic.
- Calls: tell the assistant or your Clinic if you do not want check-in calls, or do not want them recorded.
- Email: use the unsubscribe link in any email we send about Compound Care, or write to us.
- Health records: contact your Clinic to see, copy, or correct your records.
11. Your California privacy rights
This section applies to California residents and supplements this policy, as the California Consumer Privacy Act, as amended (the "CCPA"), requires. It does not cover protected health information governed by HIPAA, or information we handle only on a Clinic's behalf as its service provider; for that information, contact your Clinic.
Personal information we collected in the last 12 months
| Category | Examples | Sources | Disclosed for a business purpose to |
|---|---|---|---|
| Identifiers | Name, email address, phone number, IP address | You; your device | Service providers |
| Professional information | Practice name and role | You | Service providers |
| Internet or network activity | Pages viewed, browser, referring site | Your device | Service providers (hosting, analytics) |
| Approximate location | Derived from IP address | Your device | Service providers (analytics, security) |
We use this information for the purposes in section 4. We have not sold or shared personal information, including that of anyone under 16, and we do not use or disclose sensitive personal information for any purpose the CCPA lets you limit.
Your rights
Subject to exceptions in the law, you have the right to:
- know what personal information we collected about you, and how we used and disclosed it;
- get a copy of it;
- ask us to correct it or delete it;
- opt out of its sale or sharing (we do neither); and
- not be treated differently for using these rights.
To make a request, email hello@compoundcare.co with the subject "California privacy request." We will confirm receipt within 10 business days and respond within 45 days. We will ask for information to verify your identity, and may ask for more for a request about specific pieces of information. You may use an authorized agent, who must give us proof of your permission; we may still ask you to verify your identity with us. Under California's "Shine the Light" law, you may ask once a year whether we disclosed personal information to third parties for their direct marketing; we do not.
12. Children
The Website is not directed to children under 13, and we do not knowingly collect personal information from them through it. A Clinic may give us information about a patient of any age as part of the Services, which we protect under HIPAA.
13. Changes to this policy
We may update this policy. We will post the new version here with a new effective date, and if a change is significant, we will give additional notice, such as on the Website or in the patient portal.
14. How to contact us
Questions, requests, or complaints about this policy or our privacy practices: hello@compoundcare.co. For questions about your care or your health records, contact your Clinic.