Privacy Policy

AttorneyChiro LLC operates AttorneyChiro, a multi-tenant software-as-a-service platform. Each practice or law firm that subscribes (a "Customer") has its own isolated workspace.

Chiropractic practices that use AttorneyChiro are typically "covered entities" under the Health Insurance Portability and Accountability Act (HIPAA). When we create, receive, maintain or transmit protected health information (PHI) for a practice, we act as that practice's "business associate" under a Business Associate Agreement (BAA). We use and disclose PHI only as the BAA and HIPAA permit. If this Policy and a BAA conflict on how PHI is handled, the BAA controls.

For information we collect for our own business (for example, account and billing contacts, or visitors to our public pages), we decide how that information is used.

Information Customers put into the platform (Customer Data)

• Patient records: demographics, contact details, insurance and claim information, case and accident details, appointments, intake forms, signed consents, clinical notes, exams, treatment plans, documents and images.
• Clinical audio and transcripts, when a provider uses dictation or the voice scribe.
• Billing records: charges, statements, payments, liens and collections.
• Case information shared between a practice and a patient's personal-injury attorney.
• Staff information: names, roles, schedules, locations and time-clock punches.
• Messages, call records and delivery statuses for texts, emails and calls sent through the platform.

Account and business information

• Names, work email addresses, phone numbers and roles of Customer users, attorneys and paralegals.
• Practice and firm details, subscription plan and add-ons.
• Information you send us when you request access, onboarding or support.
• Payment details, which are collected and stored by our payment processor, Stripe. We do not store full card numbers.

Information collected automatically

• Security and access logs: IP address, browser and device information, the account used, and the date and time of each request.
• Audit records of sign-ins and of actions taken on records, including access to PHI.
• Cookies needed to keep you signed in and remember your settings (see Cookies below).

We use information to:

• Provide, maintain and support the platform for each Customer, as the Customer directs.
• Send appointment reminders, forms, statements and other messages that a practice has set up.
• Process subscription payments and, for practices that enable it, patient payments.
• Secure the platform: authenticate users, detect and prevent misuse, investigate incidents and keep audit trails.
• Troubleshoot, fix defects and improve reliability.
• Communicate with Customer administrators about their account, service changes and security.
• Comply with law, legal process and our contractual obligations, including BAAs.

We do not sell personal information or PHI. We do not use PHI for advertising. We do not use PHI to train general-purpose artificial-intelligence models.

Some optional features, such as documentation assistance, case summaries and speech-to-text, use artificial intelligence. Speech-to-text runs on computers that we operate. When a feature sends PHI to an outside AI service, AttorneyChiro only sends it to a provider that has signed a BAA with us; currently that is Microsoft's Azure OpenAI Service. In production, the platform checks for a BAA before sending PHI and blocks the request if none is on file. AI output is a draft. The provider who signs a note is responsible for reviewing it.

We share information only in these situations:

• With the Customer that owns it, and with the people that Customer authorizes, such as its staff, a patient through the patient portal, or a patient's attorney through the attorney portal.
• With service providers (subprocessors) that help us run the platform, under written contracts that limit their use of the information. Providers that handle PHI sign a BAA or equivalent terms. The current list is below.
• With third-party services a Customer chooses to connect, such as its own RingCentral, email or payroll account. The Customer's agreement with that service governs what it does with the information.
• When the law requires it, such as a valid subpoena or court order. For PHI we follow the BAA and HIPAA, and notify the Customer where permitted.
• To protect the rights, safety and security of patients, Customers, us or others.
• As part of a merger, acquisition or sale of assets, subject to this Policy and any BAA in force.

Patient text messaging may also be delivered through PatientPulse, our affiliated patient-engagement platform, which uses Twilio. If a practice turns on electronic claims, claim data goes to the healthcare clearinghouse the practice uses. Customers can request our current subprocessor list at [email protected].

Practices use the platform to send texts and automated calls to their patients, such as appointment reminders, confirmations, forms, and billing notices. Messages are sent on the practice's behalf, and the practice must have the patient's consent to contact them.

• Reply STOP to any text to stop receiving texts from that practice. Reply HELP for help. You can also ask your practice to update your contact preferences.
• Message frequency varies with your appointments and account activity. Message and data rates may apply.
• We do not share mobile phone numbers or text-messaging consent with third parties or affiliates for their marketing or promotional purposes. Text-messaging originator opt-in data and consent are not shared with any third parties, except service providers that deliver the messages.

More detail is in the SMS terms in our Terms of Service.

We use only cookies that the platform needs to work. We do not use advertising cookies, and we do not run third-party analytics or tracking scripts.

• Sign-in cookies that keep your session secure.
• A cookie that remembers a trusted device after multi-factor authentication, if you choose that option.
• Cookies that remember your language, the practice you are working in, and your cookie choices.

If you block these cookies in your browser, you will not be able to sign in.

• All traffic to the platform is encrypted in transit with TLS.
• Each Customer's data is separated at the database level by row-level security, so one Customer cannot read another Customer's records.
• Access inside a Customer's workspace is based on roles and permissions. Practices can limit providers to their own patients.
• Multi-factor authentication is available and can be required.
• Sign-ins, record changes and access to PHI are recorded in audit logs.
• Integration credentials and other secrets are encrypted in the application. Off-site backups are encrypted before they leave our servers.
• Our support staff can only see a Customer's workspace after the Customer approves a support session. These sessions are read-only, time-limited and logged.
• Backups run daily, are kept in more than one location, and are stored only in the United States.

No system is perfectly secure. If we discover a breach of PHI, we notify the affected Customer as the BAA and HIPAA require, so the Customer can meet its own notification duties. To report a security concern, email [email protected].

The platform's application and database servers are in the United States. Backups are stored only in the United States, including encrypted off-site copies with Amazon Web Services in its U.S. East region. Some of our service providers may process limited information outside the United States under contractual safeguards.

• Customer Data, including PHI, is kept for as long as the Customer's subscription is active, or as the Customer directs. Practices are responsible for meeting their own medical-record retention duties.
• Clinical voice and dictation recordings are kept for seven years and then removed automatically, unless a legal hold applies.
• Short-lived items such as sign-in links, form links and invitations expire automatically, generally within 30 to 90 days.
• Backups are overwritten on a rolling schedule, generally within about 30 days.
• When a subscription ends, we handle Customer Data as described in our Terms of Service and the BAA.

Patients

Your practice controls your health records. To see, copy or correct your records, or to ask who they have been shared with, contact your practice. If you contact us, we will forward your request to the practice and help it respond.

Customer users, attorneys and website visitors

Depending on where you live, including California and other U.S. states with privacy laws, you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, and to opt out of its sale or use for targeted advertising. We do not sell personal information or use it for targeted advertising. To make a request, email [email protected]. We will verify your identity before acting, and we will not treat you differently for exercising your rights. An authorized agent can make a request for you with proof of authority.

Marketing emails include an unsubscribe link. Account and security notices are not marketing, so they do not have an unsubscribe option.

AttorneyChiro is a business tool. It is not directed to children under 13, and we do not knowingly collect personal information directly from children under 13. Practices may keep records about minor patients. Those records are PHI that the practice controls, and a parent or guardian manages the minor's portal access.

We may update this Policy. The "Last updated" date at the top shows when it last changed. If a change is material, we will tell Customer administrators by email or in the app before it takes effect.

Questions about this Policy or our privacy practices: [email protected]. Security reports: [email protected]. For product help, see our Support page.