Privacy Policy

This policy explains how Modulon Health ("Modulon", "we", "us") collects, uses, shares and protects personal information. It applies to visitors to this website, to people who contact us about our products, and to the staff of client clinics who use the Modulon platform.

Modulon also handles information about patients on behalf of the clinics we serve: their calls and texts with the clinic, and what they enter when they book online, fill in intake forms or pay a bill. That information is protected health information (PHI), and for it we act as the clinic's business associate under the Health Insurance Portability and Accountability Act (HIPAA). PHI is governed by the clinic's own Notice of Privacy Practices and by our Business Associate Agreement with the clinic, not by this policy. Our HIPAA Notice explains what that means for patients. Clinics outside the United States sign our Data Processing Agreement instead.

Information you give us

• Contact details. Your name, email address, phone number, clinic and role when you ask for a demo, sign up for updates, ask for a report, template or call audit from our free tools, or write to us. For a call audit, also your clinic's phone number and website.
• Tool results. When you ask for a report from one of our free tools, the result you are sending, such as a calculator's total or a scorecard's score, with your region and specialty. Figures you type into a tool stay in your browser unless you ask for the report.
• Account details. For clinic staff who sign in to Modulon: name, work email, phone number, job title, role, team, permissions and sign-in credentials.
• Communications. The content of emails, calls, chats and support requests you send us.
• Billing details. Billing contacts and payment information for a clinic's subscription. Card and bank details are collected and stored by our payment processor, Stripe, not by Modulon.
• Event and survey responses. Information you provide when you register for a webinar or event, or answer a survey.

Information collected automatically

• Log data. Your IP address, browser type, operating system, referring page, the pages you request and the time of each request, recorded by our hosting providers.
• Platform activity. Inside the Modulon platform, a record of each sign-in, with the device and browser used, and of the actions each signed-in user takes, which we keep as an audit trail for the clinic and to secure the service.
• Cookies. A small number of cookies needed to run the website and keep you signed in. We do not use advertising or cross-site tracking cookies. See our Cookie Policy.

Information from others

A clinic administrator may give us your details to create your staff account, or connect a system, such as Google Workspace, that shares your name and work email with us when you sign in. We may also receive business contact information from event organizers, partners and public professional sources.

We use personal information to:

• Respond to enquiries, arrange demos and pilots, and provide customer support.
• Create and manage accounts, and provide, maintain and secure the Modulon platform.
• Bill clinics for their subscription and keep the financial records the law requires.
• Send service announcements, security notices and, where permitted, product news.
• Detect, investigate and prevent fraud, abuse and security incidents.
• Understand how the website and product are used so we can fix problems and improve them.
• Comply with legal obligations, resolve disputes and enforce our agreements.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use PHI to train general-purpose AI models, and we use it only as a clinic's Business Associate Agreement allows.

We share personal information only in these circumstances:

• Service providers. Companies that host our infrastructure, carry calls and messages, provide AI models, process payments, check insurance eligibility or help us run the business. They may use the information only to provide services to us. Every provider that handles PHI signs a Business Associate Agreement with us. Our subprocessors page lists the main ones.
• Client clinics. Information about a clinic's staff accounts and activity is available to that clinic's administrators.
• Integrations a clinic turns on. When a clinic connects Modulon to its record system, phone system, inbox or other tools, we exchange the information those connections need.
• Legal reasons. When required by law, subpoena or court order, or when we believe disclosure is needed to protect the rights, safety or property of Modulon, our clients, patients or others.
• Business transfers. As part of a merger, acquisition, financing or sale of assets, subject to this policy and to any Business Associate Agreements in force.
• With your consent. In any other case, only when you ask us to.

Modulon sends text messages to patients on behalf of their clinics, and to clinic staff about their work. We send them only to people who have agreed to receive them, and honor STOP and other opt-out requests automatically.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are never shared with any third party, except the providers that carry the messages for us.

We protect information with administrative, technical and physical safeguards suited to healthcare data, including encryption in transit and at rest, access limited by role, multi-factor authentication and audit logging. No system is perfectly secure, but we work to keep risk low and will notify affected parties as the law and our agreements require if a breach occurs. Our Security page describes our practices in more detail.

We keep personal information only as long as we need it for the purposes in this policy, or longer if the law requires. In practice:

• Sales and enquiry records are kept while there is an active conversation and for up to three years after.
• Staff account information is kept for as long as the clinic's subscription is active, and audit records of account activity for at least six years, as HIPAA requires.
• Billing records are kept for as long as tax and accounting rules require, typically seven years.
• Server logs are kept for up to 90 days for security and troubleshooting, then deleted.

When a clinic's contract ends, we return or destroy the clinic's data, including PHI, as its Business Associate Agreement specifies.

Depending on where you live, including in California, Colorado, Connecticut, Virginia and other states with consumer privacy laws, and in Europe and the Gulf, you may have the right to:

• Know what personal information we hold about you and how we use it.
• Get a copy of it in a portable format.
• Correct information that is wrong.
• Ask us to delete it.
• Opt out of marketing, and of any sale, sharing or profiling as state law defines them.
• Appeal our decision if we decline your request.

You can unsubscribe from marketing email at any time using the link in the message. To make any other request, write to hello@modulonhealth.com. We will verify your identity before acting on a request, answer within the time the law sets, and not treat you differently for exercising your rights. You may also use an authorized agent. We honor Global Privacy Control signals.

If your request concerns health information we hold for a clinic, we will pass it to that clinic, which is responsible for answering it under HIPAA.

Some state laws, such as Washington's My Health My Data Act and Nevada's consumer health data law, protect health information that HIPAA does not cover. Health information Modulon handles for clinics is PHI governed by HIPAA, and we process it only on the clinic's behalf. We do not collect consumer health data through this website, do not sell it, and do not use it for advertising.

Modulon is based in the United States. Data we hold for a clinic is stored in the clinic's own region: the United States, the European Union, the United Kingdom, or one of the six Gulf states. Our subprocessors page lists the providers in each.

Information about website visitors and enquiries is handled in the United States. If you contact us from another country, your information will be transferred to the United States, where privacy laws may differ from those where you live, with the safeguards the law of your country requires. Our EU and UK Privacy and Middle East Privacy pages explain those safeguards and the rights you have.

This website and the Modulon platform are meant for clinics and their staff, not for children. We do not knowingly collect personal information from children under 13 through the website. Information about pediatric patients is handled only on behalf of their clinic, as PHI, and requests about it are answered by the clinic.

We may update this policy as our products and the law change. We will post the new version on this page with a new date and, for material changes, notify client clinics before the changes take effect.

For questions about this policy or how we handle personal information, write to hello@modulonhealth.com. Patients with questions about their health information should contact their clinic first; we will help it respond.