This Policy applies to the Ultradoc patient app (distributed through the Apple App Store and Google Play), the patient-facing services of the Ultradoc platform, and the ultradoc.net website.

It does not replace your practice's own Notice of Privacy Practices, which governs how your practice — the HIPAA covered entity responsible for your care — uses and discloses your health information. If you use the Ultradoc platform as a member of a practice's workforce, the practice's Customer Agreement with Ultradoc governs that use.

Understanding this Policy requires one distinction.

Protected Health Information (PHI). Your appointments, messages with your care team, billing records, and the fact of your relationship with a practice are PHI. For PHI, your practice is the covered entity and Ultradoc is its business associate: we process this information only as permitted by the Business Associate Agreement with your practice and by HIPAA, and your practice's Notice of Privacy Practices governs its use. Our safeguards are described in our Statement of HIPAA Compliance.

Account and technical information. Your app account, device information, and usage analytics are information Ultradoc handles to operate the service itself. This Policy is the primary document governing that information.

The patient app asks for three optional permissions. Each is explained in the app before your device prompts you, each is refusable, and the app remains usable without any of them. You can withdraw any of them later in your device settings.

Push notifications. With your permission, the app registers your device to receive notifications — a reply from your care team, a confirmed appointment. Notifications are written to signal that something happened without putting the substance of your health information on your lock screen.

Calendar. If you turn on calendar sync, the app writes your confirmed visits to the calendar you choose on your device, and updates or removes those entries when a visit is rescheduled or cancelled. This is a one-way write: the app never uploads your calendar, and Ultradoc never reads, receives, or stores your calendar events or any other appointment on it. Nothing about your calendar leaves your device to us. Note that a calendar you sync with another provider — iCloud, Google, or your employer's server — is governed by that provider, so consider which calendar you pick.

Biometric app lock. You can require Face ID, Touch ID, or your device passcode to open the app. This check is performed entirely by your device's operating system, and the result never leaves the device. Ultradoc neither receives nor stores your fingerprint, face data, or passcode.

Ultradoc operates a text message program that sends appointment notifications, reminders to open a message or book a follow-up, task notifications to practice staff who have enabled them, and one-time sign-in verification codes. It carries no marketing or promotional content. The complete program terms are published at ultradoc.net/sms.

Two pieces of information make that program work: your mobile number, and the record that consent to text it was given — when, through which channel, and against which language. We call these together your text messaging opt-in data and consent. Patients give consent to their practice at the point of care; practice staff enable text notifications themselves in their Ultradoc account and verify the number with a one-time code.

Text messaging opt-in data and consent status are never sold, rented, or shared with any third party for marketing purposes. They are used to run the program described above and for nothing else, and they are disclosed only to the messaging provider that delivers the messages, which acts on Ultradoc's instructions under contract.

To state the point in the form the mobile carriers require: All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

You may withdraw consent at any time by replying STOP to any message, which stops the messages without affecting your account, your care, or anything else in this Policy. Ultradoc retains a record that a number opted out for as long as the number would otherwise be eligible to be texted, because honoring an opt-out requires remembering it.

The patient app uses a single analytics service, PostHog, operating under a signed Business Associate Agreement, to measure reliability and product usage. It receives three things: screen views, app lifecycle events (such as the app being opened), and crash and diagnostic reports when something goes wrong.

PostHog is never told who you are. The app does not identify you to it: your account identifier is never sent, no event is associated with your identity, and your name, email address, phone number, date of birth, message contents, and records never reach PostHog. Events are grouped by a randomly generated device identifier rather than by your account. Automatic capture of screen taps is switched off, so what you tap on a screen — including a family member's name on a card — is never recorded, and events are scrubbed on-device to strip tokens and sensitive links before transmission.

One qualification, stated plainly. A screen view records the address of the screen you opened, and the address of some screens inside the app contains the identifier of the record you were looking at — a practice, an appointment, a conversation. Those identifiers are meaningless to PostHog and to anyone else, but Ultradoc holds the records they point to and could match them up. So although analytics carry no direct identifiers, we do not claim they are anonymous. We treat them as information about your care: covered by the Business Associate Agreement, never sold, never used for advertising, and never shared for anyone else's purposes.

The app contains no advertising, no advertising SDKs, and no social media trackers. We do not track you across other companies' apps or websites, and the app never requests the ability to do so. Your health information is never used for advertising of any kind.

All communication between the patient app and the Ultradoc platform is encrypted in transit using TLS 1.2 or higher. Information at rest is encrypted with AES-256 on HIPAA-eligible cloud infrastructure operated under Business Associate Agreements. Session credentials on your device are stored in your device's secure storage, and you can additionally protect them with Face ID or fingerprint unlock.

Access to production systems is role-based, least-privilege, and fully audited. The complete control set — administrative, physical, and technical — is published in our Statement of HIPAA Compliance. Suspected vulnerabilities may be reported to security@ultradoc.net under our vulnerability disclosure policy.

If a breach of unsecured health information occurs, Ultradoc will notify affected practices without unreasonable delay, as HIPAA requires, so that patients receive the notifications they are entitled to.

Families are part of how care works, so the patient app draws a line at thirteen (13) and treats each side of it differently.

Children under 13 do not get an account. The app will not create one: an attempted sign-up with a date of birth under thirteen is refused, and no account is made. A child under thirteen is instead cared for through a managed profile that a parent or legal guardian holds inside their own adult account. The parent creates and controls that profile, sees the child's appointments and messages, and can remove it at any time. Ultradoc collects the child's information from the parent or from the practice — never from the child, who has no way to sign in and no way to give us anything directly. We do not knowingly collect personal information from a child under thirteen in any other way; if you believe we have, contact privacy@ultradoc.net and we will delete it.

Teens aged 13 to 17 may hold their own account. A teen who is at least thirteen can create an account, sign in, and use the app for their own care. A teen's account is subject to this Policy in full and gets the same protections as an adult's: the same limits on analytics, the same absence of advertising, the same right to delete. Where state law gives a minor the right to consent to a category of care on their own, or gives a parent the right to see it, that determination is made by the practice, which is the custodian of the record; the app displays what the practice makes available.

When a teen with a managed profile turns thirteen, they may take over with their own account. The parent's ability to see that care afterward is set by the practice, consistent with applicable law.

No part of the patient app is directed to children under thirteen, and it shows no advertising to anyone. We do not use any information about a minor for advertising, marketing, profiling, or model training, and we do not sell it.

When we change this Policy, we will update the effective date above and, for material changes, provide notice in the app or by email before the change takes effect. Prior versions are available on request. Continued use of the patient app after a change takes effect constitutes acceptance of the revised Policy.