HIPAA Compliance Statement

1. Overview

Propelence AI is an AI-powered software-as-a-service (SaaS) platform designed to help clinics manage appointment booking, reminders, missed-visit follow-up, and patient communication workflows.

When the platform is used with protected health information (PHI) on behalf of U.S. healthcare providers and their partners, HIPAA’s Privacy, Security, and Breach Notification Rules may apply.

This HIPAA Compliance Statement summarizes how we approach HIPAA-related responsibilities when we act as a business associate to covered entities and other business associates under HIPAA.

2. Our Role Under HIPAA

Under HIPAA, healthcare providers, health plans, and healthcare clearinghouses that transmit certain electronic transactions are "covered entities."

When a covered entity or other HIPAA business associate uses Propelence AI to create, receive, maintain, or transmit PHI for permitted healthcare purposes, Propelence generally acts as a business associate.

As a business associate, Propelence is directly responsible for complying with specific HIPAA requirements that apply to business associates, including the Security Rule and parts of the Privacy and Breach Notification Rules.

3. Business Associate Agreements (BAAs)

Before handling PHI for HIPAA-covered customers, Propelence requires a signed Business Associate Agreement (BAA) that:

• Defines permitted and required uses and disclosures of PHI by Propelence.
• Requires appropriate safeguards to protect the confidentiality, integrity, and availability of PHI.
• Addresses breach notification obligations, subcontractor relationships, and return or destruction of PHI at termination, consistent with HIPAA’s requirements for business associate contracts.

Propelence will only use or disclose PHI as allowed by the BAA or as required by law.

4. How Clinics Should Use Propelence Under HIPAA

Propelence is intended to support administrative workflows such as:

• Appointment booking, confirmations, and scheduling updates.
• Reminders, pre-visit notifications, and instructions.
• No-show follow-up and re-engagement.
• Non-emergency patient messaging and coordination.

Clinics remain responsible for:

• Determining when and how PHI is entered into the platform.
• Ensuring that their use of Propelence is consistent with permitted uses and disclosures under HIPAA.
• Configuring communication templates, consent practices, and retention rules in line with their own HIPAA policies and their BAA with Propelence.

Propelence is not a substitute for emergency services, clinical decision support, or electronic health record (EHR) systems.

5. Administrative Safeguards

Propelence implements administrative safeguards designed to align with the HIPAA Security Rule, including:

• Governance and policies: Internal policies and procedures addressing PHI handling, access, incident response, and workforce responsibilities.
• Role-based access control: Limiting PHI access to personnel whose job duties require it, with defined roles and authorization processes.
• Workforce training: Training relevant team members on HIPAA-related obligations, data protection, and incident reporting.
• Risk management and assessments: Periodic evaluation of security controls, vendor risks, and changes in architecture that could affect PHI.

Covered entities and business associates using Propelence should continue their own risk analysis and management processes as required by HIPAA.

6. Technical Safeguards

Propelence’s technical safeguards are designed to protect PHI in electronic form (ePHI), including controls such as:

• Encryption: Use of industry-standard encryption for data in transit and at rest, where PHI is stored or transmitted through the platform.
• Authentication and access controls: Account-based authentication, session management, and restrictions based on roles and permissions.
• Audit logging: Logging key system events and access patterns related to the Service to support monitoring and investigations.
• Network and application security: Use of secure development practices, network protections, and vulnerability management processes.

Specific technical details (e.g., cipher suites, key management practices, hosting environment certifications) can be provided to customers as part of due diligence and vendor risk reviews.

7. Physical Safeguards

Propelence uses cloud and hosting providers that implement physical safeguards for data centers, such as controlled facility access, environmental protections, and equipment security.

We select providers that adhere to widely recognized security frameworks and certifications relevant to healthcare and SaaS environments, and we limit physical access to PHI to authorized personnel.

8. Subprocessors and Third-Party Services

Propelence may rely on carefully chosen third-party services (subprocessors) for hosting, communications, and related functionality. When a subprocessors’ services involve PHI, Propelence:

• Enters into agreements requiring the subprocessors to safeguard PHI and follow HIPAA-aligned obligations.
• Limits PHI access to what is necessary to provide the contracted services.
• Monitors subprocessors and service changes as part of ongoing vendor management.

An up-to-date list or description of subprocessors that may handle PHI can be made available to HIPAA customers upon request.

9. Breach Notification and Incident Response

Propelence maintains processes to detect, investigate, and respond to potential security incidents involving the Service. If Propelence discovers a breach of unsecured PHI, it will:

• Notify the affected covered entity or business associate without unreasonable delay and within timeframes required by applicable law and the BAA.
• Provide information reasonably available at the time to help the covered entity meet its own breach notification obligations.
• Cooperate in investigations, mitigation steps, and follow-up actions required under HIPAA and related regulations.

Covered entities remain responsible for notifying affected individuals, regulators, and (where applicable) the media as required by HIPAA’s Breach Notification Rule.

10. Restrictions on Use and Data Blocking

Propelence will not use PHI for any purpose that would violate the HIPAA Privacy Rule or the BAA, and will not block or terminate a covered entity’s access to PHI in a way that conflicts with HIPAA’s requirements on availability and access.

If a relationship ends, Propelence will return or destroy PHI as required by the BAA and applicable law, subject to any retention requirements or agreed archival arrangements.

11. HIPAA Is One Part of Our Compliance Posture

HIPAA applies primarily to PHI in U.S. healthcare settings. Clinics may also be subject to other privacy, security, and health-data regulations (such as GDPR, PIPEDA, or national privacy laws) depending on their location and patient population.

Propelence aims to support clinics in building compliance programs that account for HIPAA alongside other applicable laws, but each clinic remains responsible for its own legal and regulatory compliance.