PracticeHQ Platform Privacy Notice
Instrument: PRIV-01 | Version: 2026-09-04.2 | Effective date: September 9, 2026
Vytivo, Inc. operates PracticeHQ. This Notice explains the information handling described below, including our own account operations and our processing for named practices. It is a notice, not a request to agree to all uses of health information. Your practice's Notice of Privacy Practices or other applicable notice separately explains its clinical-record practices and rights.
1. Who is responsible for which information
Practice information. Your named practice controls its practice workspace and its clinical and billing records. We provide technology and process information for that practice under applicable service, business-associate and other data-protection agreements. The practice is responsible for its care, workforce permissions and record decisions; we remain responsible for our own legal and contractual obligations. A support or security activity involving a practice record remains subject to the applicable practice role and restrictions.
Direct platform information. We handle account identity, authentication, platform legal history, direct business communications and other information for the account, security and administrative purposes described here. Whether a particular item is governed by HIPAA, a state medical-information law or another privacy law depends on its actual source, use and role. Even information showing a relationship with a practice can be sensitive health-related information.
Clinical functions are practice-tethered. Outside named practice workspaces, the durable login contains only the information needed for identity, security, legal history, support and limited relationship routing. It is not a standalone personal health record. A common account does not create a merged clinical record across practices or authorize a new practice to read another practice's information.
2. Information, sources and purposes
We collect and process information appropriate to the function you or a practice uses, rather than every category from every user.
| Information category | Sources | Purposes and usual recipient categories |
|---|---|---|
| Identity, contact and account information, including name, contact details, eligibility information and account identifiers | You; the inviting practice; authorized account administration | Establish and authenticate accounts, verify an invitation, route service and rights requests; available to authorized account/support providers and the relevant practice as appropriate |
| Practice affiliation, professional role and credentials | You, the practice and relevant verification sources | Establish appropriate professional capabilities, manage workforce access and protect patients; relevant practice administrators and authorized verification/support providers |
| Clinical histories, questionnaires, messages, uploads, notes, orders, results and connected-source data | You; the practice and its workforce; sources connected or disclosed through a lawful separate route | Maintain the named practice's records and provide its selected care-support services; authorized practice workforce and contracted processors within the applicable authority |
| Audio/video recordings, transcripts and AI-assisted drafts | Separately authorized encounters and their permitted processing | Transcription, documentation, clinician review and correction, authorized playback/preservation and related bounded operational support; relevant practice personnel and contracted recording/AI/storage processors |
| Legal documents, actions and request evidence | The document interaction, user or signer, practice and service systems | Prove delivery, assent, consent, refusal, withdrawal and rights handling; relevant legal-document, security and storage providers and authorized practice personnel |
| Billing and transaction references, payment status and business contact information | You, practices and applicable payment or billing services | Administer disclosed charges, reconciliation, customer service and legal records; relevant merchant/payee and contracted billing/payment providers. A payment action does not itself authorize later charges |
| Device, browser, session, access, error, performance and security information, including IP address and user agent where collected | Your use of the service and security systems | Authenticate, maintain sessions, detect misuse, investigate failures, preserve legal-action evidence and protect the service; authorized infrastructure, security and support providers |
| Support messages and attachments | You, practice personnel and authorized service providers | Answer a request, investigate a reported problem, correct errors, manage complaints and satisfy legal obligations; personnel and providers assigned to that task |
Health information may include diagnoses, treatment, laboratory information, physical or mental health, medications, reproductive or sexual health, and other sensitive categories present in the authorized practice records. Special protections follow the actual category and provenance. Merely mentioning alcohol or a habit does not make a record subject to Part 2, but a protected record received from a Part 2 program may remain protected.
We use essential cookies or similar session technologies where needed for login, security and requested functions. Ordinary technical telemetry is not permission to reconstruct the contents of your session. Optional diagnostic replay, marketing or other processing requiring a separate choice must be explained and authorized through its own interaction before it begins. This Notice does not activate those optional functions or declare that their vendors or retention arrangements are identical to ordinary security logging.
Cross-site tracking and browser signals. In the core account and practice-workspace functions described by this Notice, we do not collect personal information about your activity across other companies’ websites for behavioral profiling, and we do not permit other parties to use those functions to collect such information for their own cross-site behavioral profiling. Purpose-limited providers may process session, authentication, security and service information as described above. A standard browser “Do Not Track” signal does not change that necessary processing. We honor a legally recognized opt-out preference signal to the extent an applicable law requires it; such a signal is not consent to a new use and does not itself disconnect a practice or delete a required record. A separate external service you choose to visit or connect may use its own technologies under its own notice. Any future optional cross-site tracking within PracticeHQ requires an accurate updated disclosure and the applicable choice before that processing starts.
3. AI, recording and service improvement
We do not use patient or practice content, including de-identified derivatives, to train or fine-tune AI models. AI and processing providers that receive that content are contractually restricted from those uses. We remain responsible for our own commitments; we do not promise a vendor is technologically incapable of violating its agreement.
Permitted service processing may include requested outputs, security, error investigation, support, narrowly controlled safety or quality review and lawful de-identified or aggregated operational analytics. Identifiable review is restricted to the information, personnel, purpose and period justified by the task and applicable record rules. De-identification must satisfy applicable law, not simply remove a name. We do not use de-identification to evade the no-training commitment.
Recording, transcription and AI Scribe require their own conspicuous consent and encounter controls. Your provider may preserve an eligible recording as a practice record. Provider/workforce playback is different from optional patient replay. Group recordings are not initially distributed to participants through PracticeHQ. The recording consent explains these matters; this Notice is not recording permission.
4. When information is shared
We share information with the named practice and its authorized workforce, contracted service providers performing the functions described above, and recipients you direct or otherwise authorize through a legally sufficient route. A service provider may provide hosting, storage, communications, recording, transcription, AI processing, authentication, security, support, billing or record delivery. Its role and agreement must permit the actual data use. No provider receives a general right to train models or independently exploit practice records.
A legally required disclosure, public authority request or proceeding is evaluated under the applicable rules, including any notice, objection, privilege, Part 2 or state-confidentiality requirements. A demand does not automatically entitle its sender to every record. We may share the information lawfully necessary to investigate abuse, protect rights or security, or comply with valid legal duties, subject to those restrictions.
A merger, restructuring or service transfer may involve a lawful successor or confidential professional advisers subject to appropriate duties. Such a transaction does not itself authorize a new clinical purpose or override a required patient consent or record-custody restriction.
The service purposes in this Notice do not include selling consumer health data, independent affiliate marketing or cross-context behavioral advertising using practice clinical content. No affiliate is authorized by this Notice to receive consumer health data for an independent purpose. An affiliate used solely as a contracted service provider is subject to the same purpose and protection requirements as other providers. Before introducing a materially different direct use or an independent affiliate recipient, we will identify it in the applicable updated notice and obtain any legally required consent or separate sale authorization. This preserves lawful future changes; it does not authorize them now.
5. Connections, communications and leaving a practice
A practice connection activates the disclosed portal capabilities for that named workspace. It does not import another practice's chart or authorize an external EHR, wearable or application connection. A separate source or third-party direction identifies the relevant source, destination, information and duration where applicable. An independent recipient's later handling may be governed by its own law and notice; we will explain a material unprotected-recipient risk at the relevant direction.
Service communications follow their stated sender, purpose, channel and applicable legal basis. Marketing is not silently included in a care-message preference. Contact the sender or use the indicated preference/stop process to change a communication choice. A request for a single security code does not restore an earlier recurring-text permission.
Disconnecting a portal or closing an account stops the capabilities that depend on that connection or account, as explained by the action. It does not erase a practice's records, terminate care, revoke other consents or recover copies already delivered. Required record access remains available through the responsible practice even if optional portal functions end. Our account shell does not become the custodian of an independent personal clinical record after disconnection.
6. Retention and security
Retention depends on the information's purpose, applicable law, practice instructions and outstanding rights or legal obligations. Account/security information is kept for the justified account, security, recovery, legal or support purpose. Required legal-document evidence has its applicable documentation schedule. Clinical records and recordings used as records follow the practice's governing record obligations, not a universal platform deletion period.
Operational recordings, working transcripts and intermediate material have finite schedules for processing, verification/correction, justified operational work and disposal. Affirmative practice preservation, actual clinical-record use or a documented hold may change disposition. A hold preserves affected information but does not authorize unrelated use. Copies in processors, backups and recovery systems are governed by controlled disposition and continuing safeguards; a deletion request is not a promise of instantaneous removal from every copy.
We use reasonable administrative, physical and technical safeguards appropriate to the information and applicable law, including access restrictions and appropriate encryption and integrity controls. No system eliminates all risk. We will provide legally required incident notifications. Do not send unnecessary health information in an ordinary support email; request an appropriate secure route for sensitive attachments.
7. Your requests and rights
Practice records. Contact the practice's privacy contact for access, amendment, confidential communications, restrictions, applicable disclosure accountings or complaints about its records. Its NPP identifies the rights and exceptions. We assist under the applicable agreement. An internal label such as “operational recording” or absence of a replay button does not decide your legal access rights.
Direct platform information. Contact privacy@mypracticehq.com to ask what information we handle about you, obtain access or a copy, request correction or deletion, withdraw a consent on which a use depends, or exercise another applicable right. We will identify the responsible entity and legal route rather than treating every request as one blanket deletion instruction. We may reasonably verify identity and authority without collecting unnecessary information. Where law allows an authorized agent, we will provide the required request process; it does not confer clinical portal access.
Depending on applicable state law and exemptions, you may have rights to confirmation, access, correction, deletion, portability, recipient or third-party information, consent withdrawal, and opt-out of covered sale, targeted advertising or specified consequential profiling. We will honor a legally applicable universal opt-out signal for a covered activity. These rights are subject to the law's scope and permitted exceptions, such as required records, security, legal claims or another person's rights. We will explain a denial and any applicable appeal or review route. You will not be penalized unlawfully for exercising a privacy right.
Consumer-health data. Our separate PracticeHQ Consumer Health Data Privacy Policy explains the covered direct-platform data, sources, purposes, recipient categories and request process under Washington’s My Health My Data Act. It is separately available from a prominent homepage link; it is not another agreement or acknowledgment. Other applicable consumer-health rights remain available through privacy@mypracticehq.com. A necessary-service exception or a valid purpose-specific consent must support the particular collection or sharing; this Notice does not supply that consent.
We will use the deadline applicable to the particular request, not a longer general platform deadline. A practice-record HIPAA exception does not automatically exempt unrelated account or website information from another privacy law. For California-covered information, the categories, sources, purposes and recipient classes above describe the processing covered by this version; applicable rights to know, correct, delete, limit sensitive-information uses and opt out remain available to the extent the statute applies. We do not claim every person or every information category is covered by every state's law.
8. Changes and contact
We may update this Notice as services and law change. We will identify the effective version and provide legally required notice of material changes. New purposes or categories requiring consent will not be introduced solely through a “continued use” statement. Historical delivery and consent evidence remains intact. An update cannot retroactively authorize a disclosure that lacked authority.
For this Notice, direct platform privacy requests or help finding the responsible practice contact:
Vytivo, Inc. — Privacy
1007 N Orange St, Suite 3990, Wilmington, DE 19801
Technical support: support@mypracticehq.com | Legal: legal@mypracticehq.com
You may contact the relevant state privacy regulator or Attorney General about applicable state rights, or the U.S. Department of Health and Human Services Office for Civil Rights concerning HIPAA or Part 2. Contacting us first is not a waiver of a regulator-complaint right. No separate acceptance of this Notice is requested.