Privacy Policy
Effective
This Privacy Policy explains how Soloist Health LLC d/b/a “SoloistHealth” (“we,” “us,” “our”) handles personal information in connection with our website and the SoloistHealth platform (the “Service”). It applies to website visitors, Providers (healthcare professionals who subscribe), and Clients (individuals invited by a Provider).
1. Important note about health information (HIPAA)
When a Provider uses the Service to create, receive, maintain, or transmit Protected Health Information (“PHI”) about its Clients, we act as the Provider’s business associate under HIPAA, and we process that PHI on the Provider’s behalf under a Business Associate Agreement (BAA) — not under this Privacy Policy. That PHI is controlled by the Provider (the covered entity). If you are a Client, your rights regarding your health information — including access, amendment, and accounting of disclosures — are exercised through your Provider, whose own Notice of Privacy Practices governs that information.
This Privacy Policy describes our own collection and use of information — such as account, billing, website, and usage data — that we handle as a business, separate from PHI processed under a BAA.
Other state-health privacy laws. Some state laws (for example, Washington’s My Health My Data Act, and similar laws in Nevada and Connecticut) regulate “consumer health data” more broadly than HIPAA and may apply to health-adjacent information we collect outside of a BAA (e.g. through website forms, marketing pages, or account fields), even for residents of those states who are not Clients of a Provider.
2. Information we collect
- Account and profile information: name, email, phone, password, and for Providers, business/practice details, professional information, and public-profile content you choose to publish.
- Client account information: when a Provider invites you, or you book with a Provider through that Provider’s booking link, we process the contact details needed to create your account and connect you to your Provider.
- Content: information you submit through the Service (messages, documents, journal entries, forms, and similar). For PHI, see Section 1.
- Payment information: payments are processed by Stripe; we do not store full card numbers. We receive limited transaction metadata (e.g., status, amounts, last four digits) from Stripe.
- Usage and device information: log data, IP address, device and browser type, pages viewed, and similar analytics, collected through cookies and similar technologies.
SMS/text messages. If you or your Provider enable text message notifications (sent via Twilio), we send them only with the consent required by applicable law (including the Telephone Consumer Protection Act). Message and data rates may apply, and you may opt out at any time by replying STOP or through your account settings.
3. How we use information
We use information to: provide, operate, secure, and improve the Service; create and manage accounts; process subscriptions and payments; send transactional and service communications; provide support; monitor for fraud, abuse, and security incidents; comply with legal obligations; and enforce our Terms. We use PHI only as permitted by the applicable BAA.
4. How we share information
We share information with service providers (subprocessors) that help us operate the Service, under contractual confidentiality and data-protection obligations (and BAAs where they handle PHI). We may also share information to comply with law or valid legal process, to protect rights, safety, and the integrity of the Service, and in connection with a merger, acquisition, financing, or sale of assets (subject to this Policy and applicable BAAs). We do not sell personal information or share personal information for cross-context behavioral advertising, and we do not use PHI for advertising.
5. Subprocessors
We rely on the following categories of subprocessors.
- Hosting / infrastructure: Vercel (application hosting), Neon (database), Amazon Web Services (file storage), Google (workspace and productivity tools).
- Payments: Stripe.
- Email: AWS SES.
- Realtime messaging: AWS.
- SMS (if enabled): Twilio.
- Telehealth video: none. Video sessions take place on a platform your Provider selects and controls, such as Zoom, Doxy.me, Google Meet, or Microsoft Teams. That platform is your Provider’s vendor, not our subprocessor; we store and display only the meeting link your Provider enters.
- Error monitoring / logging: Sentry.
6. Data retention
We retain account, billing, and usage information for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements, in accordance with our Data Retention Policy. Retention and deletion of PHI are governed by the applicable BAA and the Provider’s instructions, and Providers remain responsible for their own record-retention obligations under applicable law.
7. Security
We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit and at rest, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach of unencrypted personal information that triggers notification obligations under applicable state law, we will notify affected individuals and any required regulators as and to the extent required by that law; breaches involving PHI are handled under the applicable BAA.
8. Your choices and rights
You may access and update certain account information in your settings. Clients: to exercise rights regarding your health information, contact your Provider (see Section 1). Depending on where you live, you may have rights under laws such as the California Consumer Privacy Act or other state privacy laws (e.g., to access, correct, or delete certain personal information). To make a request about information we control as a business, contact us at privacy@soloisthealth.com.
How we respond to requests. We will verify your identity before acting on a request, will respond within the time required by applicable law (generally 45 days, with a possible extension), and will not discriminate against you (e.g. by denying service or charging a different price) for exercising your privacy rights. If we deny a request, you may have the right to appeal by contacting us at privacy@soloisthealth.com; you may also designate an authorized agent to submit a request on your behalf where permitted by law.
9. Cookies and analytics
We use cookies and similar technologies to operate the Service and to remember preferences. You can control cookies through your browser settings.
10. Children’s privacy
The Service is not directed to children for the purpose of our own direct data collection, and we do not knowingly collect personal information from children under 13 through our website. Where a Provider uses the Service to treat a minor, that minor’s health information is PHI handled on the Provider’s behalf under the BAA and governed by the Provider’s practices and applicable law.
11. Changes to this Policy
We may update this Policy; we will post the updated version with a new “Last updated” date and, where appropriate, provide additional notice. This Policy is incorporated into, and should be read together with, our Terms of Service and (for PHI) the applicable BAA; in the event of a conflict specifically regarding PHI, the BAA controls.
12. Contact
Soloist Health LLC, 418 Broadway, Ste N, Albany, NY 12207. Email: privacy@soloisthealth.com.