Privacy Policy

1. Overview

Propelence ("Company", "we", "us", or "our") provides an AI-powered software-as-a-service platform that helps clinics manage scheduling, reminders, no-show follow-up, and multi-channel patient communication (the "Service").

This Privacy Policy explains how we collect, use, disclose, and protect personal information when individuals visit our website at https://propelence.ai, use the Service, or otherwise interact with us.

This Policy is written for users located in the United States, the United Kingdom, Canada, Australia, and New Zealand. Where mandatory privacy or health-data laws in your country give you rights that cannot legally be restricted, this Policy applies subject to those laws (for example, HIPAA and U.S. state privacy laws, UK/EU GDPR, UK Data Protection Act, Canada’s PIPEDA, Australia’s Privacy Act, and New Zealand’s Privacy Act).

2. Who We Are and Roles Under Privacy Laws

For most activities described in this Policy, we act as a data controller (or "organization" under some laws) when we decide what personal information we collect via our website and marketing.

When clinics and healthcare organizations use the Service to manage their own patient communications and scheduling, we typically act as a data processor (or "business associate" under HIPAA) to process information on their behalf under a separate agreement.

In those cases, the clinic or healthcare organization remains primarily responsible for its own legal basis for processing personal information, notices, consents, and responding to rights requests from its patients.

3. Information We Collect

The types of personal information we collect depend on how you interact with us and how your clinic configures the Service.

3.1 Information You Provide Directly

We may collect information that you provide when you:

• Visit our website, request a demo, or contact us (e.g., name, clinic name, role, email, phone, message content).
• Create or manage an account for the Service (e.g., login credentials, user profile details).
• Configure clinic settings, scheduling rules, communication templates, or workflow preferences.
• Communicate with us by email, chat, phone, or other channels.

3.2 Information Collected Through the Service

When clinics use the Service, we may process information on their behalf that can include:

• Patient-facing communications and responses (e.g., appointment requests, confirmations, reminders, rescheduling, no-show follow-up messages).
• Scheduling and appointment metadata (e.g., appointment date, time, location, clinic personnel involved).
• Communication channel details (e.g., phone numbers, email addresses, messaging handles associated with a clinic’s patients or contacts).
• Operational logs, activity history, and configuration files needed for security, auditing, and support.

Depending on how a clinic uses the Service, some of this information may qualify as protected health information (PHI) under HIPAA or health-related personal data under GDPR and similar laws.

3.3 Automatically Collected Information

We may automatically collect certain information when you visit the website or use the Service, including:

• Device and browser information (e.g., IP address, operating system, browser type, language settings).
• Usage data (e.g., pages viewed, features used, time and date of activity, referring URLs).
• Cookies, SDKs, or similar technologies for authentication, session management, preferences, analytics, and security.

We typically use this information to secure the Service, understand usage patterns, improve performance, and provide a better user experience.

3.4 Information From Third Parties

We may receive limited information about you from:

• Clinics or healthcare organizations that invite you to use the Service.
• Integration partners or communication providers (e.g., SMS gateways, email services, patient engagement platforms) when permitted by law and contractual terms.

4. How We Use Personal Information

We use personal information for purposes that are consistent with applicable privacy and health-data laws.

4.1 Providing and Improving the Service

We use information to:

• Operate, maintain, and provide the website and Service.
• Authenticate users, manage accounts, and enable features.
• Route and deliver clinic communications, booking flows, reminders, and follow-up messages.
• Monitor performance, troubleshoot issues, and improve functionality based on aggregated trends.

4.2 Customer Support and Communications

We may use your information to:

• Respond to inquiries, support requests, or feedback.
• Send service-related notifications such as updates, outages, and security alerts.
• Provide onboarding, training, and operational guidance to clinics.

4.3 Legal, Security, and Compliance Purposes

We may use information to:

• Protect the security and integrity of our systems and users.
• Detect, prevent, and respond to abuse, fraud, misuse, or security incidents.
• Maintain logs and records necessary to meet contractual, healthcare, privacy, and security obligations.
• Comply with legal requirements, enforce our agreements, and cooperate with lawful requests from regulators or law enforcement where appropriate.

4.4 Marketing (Limited and Optional)

Where permitted by law and your preferences, we may use business contact information to:

• Send you information about new features, case studies, events, or resources relevant to clinics.
• Perform simple audience segmentation based on clinic type, country, or product usage, in a way that respects opt-out and consent rules.

You can opt out of non-essential marketing communications at any time by following unsubscribe instructions or contacting us.

5. Legal Bases for Processing (UK, EU, and Similar Regimes)

When privacy laws such as UK/EU GDPR apply, we rely on one or more of the following legal bases for processing personal data:

• Performance of a contract: To provide the Service under our agreement with clinics or with you as a user.
• Legitimate interests: To secure the Service, improve features, communicate with business users, and prevent misuse, where these interests are not overridden by your rights and interests.
• Consent: For certain optional activities such as some forms of marketing, analytics, or cross-border transfers, where local law requires consent.
• Legal obligations: To comply with laws relating to healthcare, privacy, security, retention, accounting, tax, and similar areas.

When we act as a processor for clinics, they are responsible for their own legal basis and notices to their patients.

6. How We Share Personal Information

We do not sell personal information in the traditional sense of exchanging data for money, and we do not share PHI for independent marketing purposes.

We may share information in the following ways:

6.1 Service Providers and Subprocessors

We may share personal information with trusted service providers that help us deliver the website and Service, such as hosting providers, communication gateways, analytics tools, security vendors, and support tools.

These providers are bound by contracts that require appropriate confidentiality, security, and legal compliance.

6.2 Clinics and Healthcare Organizations

When we process information on behalf of a clinic, relevant data (such as communication logs, appointments, or patient message content) is shared with that clinic according to its configuration and internal policies.

6.3 Legal and Safety

We may disclose personal information to law enforcement, regulators, courts, or related parties when reasonably necessary to:

• Comply with applicable law, regulation, or legal process.
• Protect individuals’ vital interests, health, or safety.
• Defend our legal rights, enforce agreements, or investigate misuse of the Service.

6.4 Business Transfers

If we are involved in a merger, acquisition, reorganization, or sale of assets, personal information may be transferred as part of the transaction, subject to continued protections and this Policy.

7. International Data Transfers

Because we serve clinics in multiple countries, personal information may be processed in countries other than the one where the data was originally collected.

We aim to implement measures required by applicable law to protect transferred data, which may include:

• Using data centers and providers that meet recognized security and compliance standards.
• Applying contractual safeguards such as standard contractual clauses for transfers from the UK/EU to other countries, where required.
• Limiting access to PHI and sensitive health information to roles and regions consistent with healthcare and privacy frameworks.

Where laws like GDPR restrict cross-border transfers, we will rely on lawful mechanisms and ensure an adequate level of protection for personal data.

8. Retention of Personal Information

We keep personal information for as long as reasonably necessary to:

• Provide the Service and fulfill our contractual obligations.
• Meet legal, regulatory, and healthcare retention requirements.
• Resolve disputes, protect our rights, and enforce agreements.

For some healthcare data, retention periods may be influenced by rules such as HIPAA record-keeping requirements or national health record regulations.

When we no longer need personal information for any permissible purpose, we will take steps to delete, de-identify, or anonymize it, subject to technical and legal constraints.

9. Your Privacy Rights

Your rights depend on where you live and which privacy laws apply. Subject to certain conditions and exceptions, you may have rights such as:

9.1 Access and Correction

You may have the right to request access to personal information we hold about you and to ask for corrections of inaccurate or incomplete information.

9.2 Deletion and Restriction

You may have the right to request deletion of your personal information or to ask us to restrict how we use it, especially where we no longer need it or where local law provides an "erasure" or "right to be forgotten" remedy.

9.3 Objection to Processing

You may have the right to object to certain types of processing, including direct marketing or processing based on our legitimate interests, particularly in GDPR jurisdictions.

9.4 Data Portability

In some cases, you may request a copy of your personal information in a structured, commonly used format where technically feasible and required by law.

9.5 Healthcare and Patient Requests

When we process information on behalf of a clinic, we may direct requests to that clinic, which is typically the entity responsible for patient records, legal bases, and healthcare-specific rights under HIPAA and other laws.

9.6 How to Exercise Rights

To exercise your rights, contact us using the details in the "Contact Us" section. We may need to verify your identity and clarify which data or interactions your request relates to.

We will respond within the timeframes required by applicable law and explain any reasons if we cannot take the action you request.

10. Cookies and Similar Technologies

We use cookies and similar technologies for purposes such as:

• Keeping you signed in and maintaining session security.
• Remembering preferences and basic settings.
• Collecting aggregated analytics about site usage and performance.

Where required by law (for example, in some UK/EU contexts), we may display a cookie banner or provide settings so you can manage non-essential cookies.

You can also manage cookies through your browser settings, though disabling certain cookies may affect functionality.

11. Security

We implement technical and organizational measures intended to protect personal information against unauthorized access, loss, misuse, or alteration.

These measures may include:

• Encryption of data in transit and at rest.
• Role-based access controls and authentication measures.
• Network and application security controls.
• Logging, monitoring, and incident response procedures.
• Vendor due diligence and contractual security commitments.

No system is completely secure, but we aim to align our controls with healthcare, privacy, and security best practices relevant to SaaS platforms.

12. Children’s Privacy

The website and Service are intended for use by clinics and adults in professional roles. We do not knowingly collect personal information directly from children without involvement from their healthcare providers or guardians.

If you believe we have collected personal information from a child in a way that is inconsistent with applicable law, please contact us so we can investigate and take appropriate action.

13. Third-Party Websites and Services

Our website and Service may contain links to, or integrate with, third-party websites, apps, or services that we do not control.

This Privacy Policy does not apply to those third parties. Their own privacy and security practices govern how they handle personal information.

Before using third-party services, you should review their privacy notices and terms.

14. Country-Specific Information

Because privacy rules differ by country, the following sections summarize notable points for key jurisdictions.

14.1 United States (Including HIPAA)

For U.S. users, personal information may be subject to a mix of federal and state privacy laws. When our platform is used with PHI for covered entities or business associates, HIPAA’s Privacy, Security, and Breach Notification Rules may apply.

In those situations, we generally act as a business associate to healthcare organizations and follow obligations defined in business associate agreements and applicable law.

14.2 United Kingdom and European Union (UK/EU GDPR)

For users in the UK or EU, the UK GDPR and EU GDPR require transparency, legal bases for processing, data subject rights, and safeguards for international transfers.

We rely on appropriate legal bases as described earlier and implement measures such as contractual safeguards for transfers, where required.

14.3 Canada

For users in Canada, federal and provincial privacy laws such as PIPEDA may apply. We aim to align our practices with expectations around notice, consent, reasonableness, access, and security under those frameworks.

14.4 Australia

For users in Australia, the Privacy Act and Australian Privacy Principles govern how personal information is collected, used, disclosed, and stored, including obligations about cross-border transfers.

We will handle personal information in a way that is consistent with those principles for users located in Australia.

14.5 New Zealand

For users in New Zealand, the Privacy Act sets out information-privacy principles covering collection, storage, security, access, correction, and disclosure.

We will handle personal information in a way that respects those principles for users located in New Zealand.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable laws.

When we make material changes, we will update the "Last updated" date and may provide additional notice (such as a banner or email) where appropriate or required.

If you continue to use the website or Service after an updated Policy takes effect, we will treat that as your acknowledgement of the changes, where permitted by law.