HIPAA Notice

Modulon provides software and services to healthcare providers. Under the Health Insurance Portability and Accountability Act (HIPAA), those providers are covered entities, and Modulon is their business associate: we create, receive, maintain and transmit protected health information (PHI) only to perform services for them.

If you are a patient, your clinic decides how your information is used, and its Notice of Privacy Practices describes your rights. This page explains how Modulon handles your information on your clinic's behalf. It does not replace your clinic's notice.

You may be dealing with Modulon, on behalf of your clinic, when:

• You call your clinic and an automated receptionist answers, books a visit or takes a message.
• You get a text from your clinic about an appointment, a form, a refill, a result or a bill.
• You book online, fill in intake forms, or pay a balance through a link your clinic sends.
• Your provider uses an AI note taker to draft the notes from your visit.
• Your clinic checks your insurance, submits a claim or requests a prior authorization.

In each case you are dealing with your clinic. Modulon acts only on its instructions, and within the rules it sets.

Depending on the services a clinic uses, Modulon may handle:

• Names, dates of birth, contact details and other demographic information.
• Recordings and transcripts of calls, and the content of texts and messages with the clinic.
• Appointment history, referrals, intake forms, photos and documents sent to the clinic.
• Visit audio and the notes drafted from it, refill requests, and results routed to patients.
• Insurance details, eligibility responses, prior authorizations, claims and payment records.

We use and disclose PHI only as our Business Associate Agreement with the clinic and HIPAA allow, which means:

• To provide the services the clinic has engaged us for, such as answering calls, scheduling and billing.
• To subcontractors who help us provide those services, such as our cloud, telephony and AI providers, each bound by its own Business Associate Agreement.
• To the systems your clinic has connected, such as the system that holds your medical record, and to your insurer when the clinic checks your coverage or submits a claim.
• For our own proper management and administration, and to meet our legal responsibilities.
• When required by law.

We do not sell PHI, use it for marketing, or use it to train general-purpose AI models. We use and disclose only the minimum necessary to perform each task, and we store and process PHI only in the United States.

• When you call or text your clinic and an automated assistant responds, it will tell you so. You can ask for a person at any time, and it will transfer you or have someone call you back.
• The assistant follows the rules your clinic sets. It does not give medical advice; anything clinical is passed to your clinic's staff.
• Results, refills and other clinical messages are approved by a clinician at your clinic before they reach you.
• Visit notes drafted by the AI note taker are reviewed and signed by your provider.

Calls answered by Modulon are recorded and transcribed so your clinic can follow up and keep accurate records. You will be told at the start of the call. If you would rather not be recorded, ask for a person or contact your clinic another way.

If your provider uses the AI note taker, your clinic will ask for your agreement before recording your visit. You can say no, and it will not affect your care. Visit audio is deleted once your provider signs the note, unless your clinic chooses to keep it.

Texts you receive through Modulon are sent on behalf of your clinic, about your care and your account with it: appointment reminders and confirmations, openings, forms, refills, results that are ready, and bills. Your clinic will not text you for marketing through Modulon without your separate consent.

• Reply STOP to any text to stop receiving texts from your clinic. Reply START to begin again.
• Reply HELP for help, or call your clinic.
• Message frequency varies. Message and data rates may apply.
• Carriers are not liable for delayed or undelivered messages.

Texts avoid clinical detail where they can, and link to a secure page for anything sensitive. Your mobile number and consent to receive texts are never shared with anyone for their own marketing. Our Patient Terms set out the full terms for texts.

We maintain the administrative, physical and technical safeguards the HIPAA Security Rule requires, including:

• Encryption of PHI in transit and at rest.
• Access limited by role, with multi-factor authentication and prompt removal when access is no longer needed.
• An audit trail of every action taken in the platform, by staff and by the AI, and the reason for it.
• Clinic policies enforced in software, which the AI cannot override.
• Regular risk assessments, workforce training and a written incident response plan.

Our Security page describes these practices in more detail.

If we discover a breach of unsecured PHI, we notify the affected clinic without unreasonable delay, and no later than ten business days after discovering it. Your clinic is then responsible for notifying you, and we give it the information it needs and help it do so.

Under HIPAA, you have the right to:

• See and get a copy of your health records.
• Ask your provider to correct your records.
• Get a list of certain disclosures of your information.
• Ask your provider to limit how it uses or shares your information, or to contact you in a particular way.
• Get a copy of your provider's Notice of Privacy Practices.
• File a complaint if you believe your privacy rights have been violated.

Because your clinic controls your records, please make these requests to your clinic. If you send a request to Modulon, we will forward it to your clinic within five business days and help it respond within the time HIPAA allows.

For questions about how your clinic uses your information, contact your clinic's privacy officer. For questions about Modulon's handling of PHI, write to hello@modulonhealth.com.

You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr/complaints. You will not be retaliated against for filing a complaint.

Modulon signs a Business Associate Agreement with every clinic before handling any PHI, and holds a Business Associate Agreement with every subcontractor that does. To request our agreement or our security documentation, write to hello@modulonhealth.com.