Privacy Policy

Run Practice Inc., a Delaware corporation (“RunPractice,” “we,” “us”), 425 Madison Avenue, Floor 14, New York, NY 10017, provides the platform that independent practices use to schedule and see patients, communicate with them, take payments and run AI employees. This Privacy Policy explains how we handle personal information:

• when you visit runpractice.ai, book a demo, subscribe to our newsletter or contact us;
• when practices and their staff use our services; and
• in our role for patient information we process on behalf of practices.

Two roles

For our website and customer relationships, RunPractice decides how information is used. For patient information in the services, the practice decides and we act as its service provider. Under HIPAA, we are the practice’s business associate. The practice’s Notice of Privacy Practices and policies govern that information. See Patient information we process for practices.

From visitors and prospects

• Contact and practice details you send us, such as your name, email, phone number, practice name, role and what you’d like to see, when you book a demo or ask a question.
• Newsletter sign-ups: your email address.
• Device and usage information when you visit, such as IP address, browser type, pages visited and the date and time, recorded by our servers and service providers.

From customers and their staff

• Account information: names, work email addresses, roles, and sign-in and security information.
• Billing information: billing contacts and payment details, processed by our payment provider.
• Support and communications with us.
• Usage information about how the services are used and perform.

Patient information we process for practices

The practice decides what is collected. Depending on the features it uses, this can include contact and identity details, appointments and booking history, forms and consents, messages (texts, email, portal and website chat), call recordings and transcripts, visit recordings and draft notes when the patient consents, health records such as conditions, medications, lab results and care plans, insurance and payment records (not full card numbers), and documents and photos the patient uploads.

• To provide and operate the services and support our customers.
• To schedule and run demos and answer questions.
• To bill customers and manage accounts.
• To keep the services secure and prevent fraud and abuse.
• To understand and improve our website and services, using usage information.
• To send product updates and our newsletter to business contacts. You can unsubscribe at any time.
• To comply with the law and enforce our agreements.

Patient information is used only to provide the services to the practice, as the practice instructs and our agreements allow. We never use it for our own marketing or to build advertising profiles.

• The AI employees process information to carry out the tasks a practice sets up, such as answering messages and calls, booking, preparing visits, drafting notes and following up.
• A visit is recorded for AI Scribe only after the patient consents. If the patient doesn’t consent, the visit isn’t recorded.
• Clinical drafts are reviewed and approved by the practice’s practitioners before they become final. Clinical questions go to the practice’s team.
• We don’t use patient information to train AI models used for other customers, and we don’t allow our service providers to train their models on it.

• With the practice. Patient information goes to the practice that serves the patient and to the systems the practice connects, such as its EHR or calendar.
• With service providers for hosting, text messaging and telephone carriers, email, payment processing (Stripe), AI models and customer support. They work under contracts that limit how they may use the information and, for protected health information, under business associate agreements where required. Our current subprocessors are listed at runpractice.ai/subprocessors.
• For legal and safety reasons: to comply with the law, respond to lawful requests, and protect the rights, safety and security of patients, customers, RunPractice and others.
• In a business transfer, such as a merger, acquisition or sale of assets, subject to commitments at least as protective as this policy.
• With your consent or at your direction.

We don’t sell personal information, and we don’t share it for cross-context behavioral advertising.

Practices use RunPractice to send appointment-related text messages to patients who agreed to receive them, and we may text customers about their accounts. The SMS Terms of Service describe the program.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-message opt-in data and consent are not shared with any third parties, except the service providers that deliver the messages.

Reply STOP to any message to opt out, or HELP for help.

Our website uses a small amount of browser storage and loads some content, such as fonts, from other services. We don’t use advertising cookies. The Cookie Policy explains what we use and the choices you have.

• Information is encrypted in transit and at rest.
• Only authorized users can access patient and practice information.
• Relevant verification, changes, approvals and handoffs are logged.
• Each practice’s information is kept separate.
• Identity is verified before patient-specific information is shared or appointments are changed.
• Business associate agreements are in place with vendors that handle protected health information.
• We store and process protected health information in the United States.
• Card details stay with Stripe.

No system is perfectly secure. If a breach affects your information, we’ll notify the practice or you as the law and our agreements require.

• Visitor and prospect information: as long as needed to respond to you and follow up. We delete or de-identify it when it’s no longer needed.
• Customer account and billing records: for the life of the account, then as long as needed for tax, accounting and legal purposes.
• Patient information: as the practice instructs and our agreements provide. We don’t delete it while the practice is a customer. The practice is the legal keeper of its patient records and must keep them for years under state law, for example six years in New York, seven in Texas and five in Florida.
• When a practice leaves: it has 30 days to export its data. After that we destroy what remains, or return it if the practice asks, as our Business Associate Agreement provides, unless the law requires us to keep it.
• Prescription records: kept for at least two years for controlled substances, as DEA rules require, and longer where state law requires.
• Security logs and HIPAA documentation: kept for six years.
• Backups are overwritten in their normal cycle.

• Marketing email: use the unsubscribe link in any message.
• Account holders can update their information in the app or by contacting us.
• Patients: your practice controls your records. Contact it to access, correct or delete them or to exercise your HIPAA rights. If you contact us instead, we’ll pass your request to your practice and help it respond.

Privacy rights under state law

Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy, to correct or delete it, and to opt out of certain processing, without being treated differently for using these rights.

To make a request, email [email protected] with “Privacy request” in the subject line. We’ll verify your identity by matching information we already hold, such as confirming your email address. An authorized agent may make a request for you with your written permission, and we may ask you to confirm it. We respond within the time the law requires. If we decline your request, you may appeal by replying to our answer. If you’re not satisfied with the outcome, you may contact your state attorney general.

In the past 12 months we collected these categories of personal information: identifiers (such as name, email address, phone number and IP address); customer records (such as billing contacts); commercial information (such as subscriptions); internet or other electronic network activity (such as pages visited); professional information (such as practice name and role); and account log-in credentials.

• Sources: you, your practice (for staff accounts), our service providers, and information collected automatically.
• Purposes: those described in How we use information.
• Disclosures for business purposes: to our service providers and to the practices we serve.
• No sale or sharing: we don’t sell or share personal information, and we don’t knowingly sell or share the personal information of consumers under 16.
• Sensitive information: we use account log-in credentials only to provide and secure the services, not to infer characteristics about you.
• Opt-out preference signals: we treat a Global Privacy Control signal as a request to opt out of sale and sharing for that browser.

Patient information we process for practices is generally governed by HIPAA or California’s Confidentiality of Medical Information Act and is exempt from the California Consumer Privacy Act. The practice handles those requests.

Our website isn’t directed to children under 13, and we don’t knowingly collect their personal information for our own purposes. Practices may manage the records of patients who are minors in the services, with the involvement of parents or guardians under their own policies and the law.

We may update this policy and will post the new version here with a new date. We’ll tell customers about material changes by email or in the services.

Questions or requests: RunPractice · [email protected]