Privacy Policy for OpenHand Inc.

1. Introduction

OpenHand Inc. ("OpenHand," "we," "our," or "us") provides Sidekick, a desktop application that helps users capture information from telehealth visits, create real-time notes and transcripts, and generate post-visit summaries and suggested next steps. This Privacy Policy explains how we collect, use, disclose, and protect information when you use Sidekick and related OpenHand services.

2. Information We Collect and Process

• Account Information: Your name, email address, and account or authentication information.
• Visit Information: Sidekick processes audio from your telehealth visit in real time to create transcripts, notes, summaries, and suggested next steps, which may include health information discussed during the visit. OpenHand does not store or retain visit audio recordings.
• Technical Information: Device and app information, IP address, logs, diagnostics, and security events needed to operate, troubleshoot, and protect the service.
• Communications and Feedback: Information you provide when you contact us, request support, complete a survey, or give product feedback.

Sidekick may request device permissions needed for features you choose to use, such as permissions required to capture visit audio. You can manage those permissions through your device settings.

3. How We Use Your Information

• Provide Sidekick's note-taking, transcription, summary, and next-step features.
• Maintain your account, provide support, and troubleshoot or improve service reliability.
• Protect the service, investigate misuse or security incidents, and maintain necessary audit records.
• Communicate with you about Sidekick, support requests, and material policy or service updates.
• Comply with applicable law and enforce our agreements.

We do not sell your personal information or health information.

4. How We Share Information

We may disclose information to service providers that support hosting, storage, transcription, AI processing, security, authentication, and other functions needed to operate Sidekick. These providers may process information only for authorized purposes under our agreements and applicable law.

We may also disclose information: (a) to a health care provider or organization when you direct us to do so or when Sidekick is provided through that organization; (b) when required by law or reasonably necessary to protect rights, safety, or security; (c) in connection with a merger, financing, acquisition, or sale of assets; or (d) with your consent or direction.

5. Data Security

We use administrative, technical, and organizational safeguards designed for sensitive information, including encryption in transit and at rest, restricted access to production data, security logging, and separation of production systems from development environments. We also seek to minimize the information used for processing and limit employee access to circumstances where it is needed.

No system can be guaranteed completely secure. If a security incident requires notice under applicable law, we will provide notice as required.

6. Audio Capture, Transcription, and Consent

Laws and rules governing audio capture and transcription vary by location and context. Before using Sidekick to capture or transcribe a telehealth visit, you are responsible for making sure you have the legal right to do so and for providing any notice or obtaining any consent required from the clinician and other participants.

7. Data Retention and Deletion

We retain information for as long as reasonably necessary to provide and secure Sidekick, meet legal or contractual requirements, resolve disputes, and enforce our agreements. Retention periods may vary by the type of information and the context in which it was collected.

You may request deletion of your account and associated information by contacting us. After a valid deletion request is processed, information will be deleted from active systems as required by applicable law, subject to permitted legal, security, and operational exceptions. Limited copies may remain temporarily in backups, security records, or service-provider systems until their normal retention periods expire. Account deletion is intended to be final.

8. Your Rights and Choices

Depending on where you live and how Sidekick is provided to you, you may have rights to request access to, correction of, or deletion of your personal information, and additional rights concerning health information. We may need to verify your identity before completing a request. You may also change or revoke device permissions at any time, although doing so may limit related Sidekick features.

9. Health Information and HIPAA

OpenHand complies with health privacy laws that apply to it. If OpenHand processes protected health information on behalf of a HIPAA-covered organization under a business associate agreement, that agreement and the organization's privacy notice may also govern. HIPAA does not necessarily apply to information you provide directly to a consumer health application such as Sidekick.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last Updated" date and provide any additional notice required by law.

11. Contact Us

If you have questions about this Privacy Policy or want to make a privacy request, contact us at support@openhand.health.