Privacy Policy

HepBuddy ("HepBuddy", "we", "us") helps physical-therapy patients complete their home-exercise program and keeps a buddy the patient chooses in the loop with progress updates. This policy explains what information we collect, how we use it, and the choices you have. HepBuddy is operated by Harrison Shu (sole proprietor), Seattle, WA, United States.

A physical-therapy clinic that uses HepBuddy controls its patients' health information. HepBuddy handles that information on the clinic's behalf, as its business associate under HIPAA and a signed business associate agreement (BAA). Where this policy and the clinic's BAA differ about patient health information, the BAA controls. You can read our standard BAA.

Information we collect

• Patient details: the patient's name, mobile phone number, email address, time zone, and the condition their exercise program targets, entered by the clinic with the patient's consent.
• Program activity: the exercises a patient is assigned, which sessions and sets they log, and the difficulty (RPE) and pain ratings they enter after a session.
• Exercise videos: videos a clinic's therapists record and upload to demonstrate exercises. A video can show a therapist or a patient.
• Consent records: a patient's consent to texts or email, and their signed authorization to share progress with a buddy. A signature record includes the signer's name, the date, and the IP address and browser used.
• Support contact details: the first name and mobile phone number or email address of a support contact, which the support contact enters and consents to themselves on a HepBuddy web page. HepBuddy does not collect a support contact's number from anyone else.
• Clinic account details: the names and email addresses of clinic staff who use HepBuddy, the clinic's name and practice ZIP code, how the clinic first found HepBuddy, and its billing status. Our payment processor, Stripe, holds card details. We never see a full card number.
• Message records: the text and delivery status of the SMS messages and emails we send and receive, for support and compliance.
• Website usage: for visitors to our public marketing pages only, how those pages are used. See Website analytics below.

How we use information

• Send patients reminders and links to complete their home-exercise sessions, by text or by email, whichever they chose.
• Send the patient's buddy progress updates so they can encourage the patient.
• Share progress and adherence with the patient's physical-therapy clinic, and build the remote therapeutic monitoring records the clinic reviews.
• Operate and support the service.

We do not use patient information for marketing, and we do not send it to any AI service or use it to train an AI model.

How we share information

We share information only with:

• The patient's physical-therapy clinic, which uses HepBuddy to support that patient's care.
• The patient's support contact, who has themselves opted in to receive progress updates.
• Service providers that store the data and deliver our messages: Google Cloud, Google Workspace, and Spruce Health. Each has signed a BAA with HepBuddy and may process information only to provide its service to us. Our vendor list names each one and the data it gets. Texts also pass through each recipient's mobile carrier.

We may also disclose information where required by law.

Between Visits newsletter

If you request Between Visits, we save your email address, where you signed up, your subscription status, and records of your signup and unsubscribe choice. We use these records to send a welcome email and the weekly newsletter, and honor opt-outs. The newsletter includes occasional HepBuddy ideas. Google Cloud stores these records, and Google Workspace delivers the emails.

Your subscription starts when you sign up. You can unsubscribe using the link in a newsletter email. This stops only Between Visits, not clinic or patient service messages. We retain the unsubscribe record to avoid sending you the newsletter again unless you sign up again.

We also use browser storage to remember when you dismiss the newsletter invitation, hiding the popup for 30 days. On the browser where you sign up, we remember that you subscribed and stop showing the popup. Unsubscribing updates that preference. This browser record contains no email address. Clearing site storage removes the preference.

Website analytics

This public website uses PostHog to understand how visitors find and use these pages, so we can improve them. PostHog acts as our service provider and processes this information only on our behalf.

For visitors to this website we collect pages viewed, clicks and scrolling on the page, approximate location derived from IP address, browser and device type, the referring site, and any campaign tags in the link you arrived from. We may also record a playback of the visit to see where pages are confusing. This is set through cookies and similar browser storage.

We also set one small cookie of our own that remembers the referring site and campaign tags of your first and most recent visit, for up to 90 days. If you then create a clinic account, we save that record with the account, along with your answer to "How did you hear about HepBuddy?", so we know which of our posts and pages bring clinics to us.

This applies to our public marketing pages only. We do not run website analytics or session recording inside the patient exercise app or the clinic dashboard, and this analytics data is never combined with a patient's health or exercise information.

If your browser sends a Global Privacy Control or Do Not Track signal, or you use an ad or tracker blocker, we do not receive this data. You can also clear or block cookies for this site in your browser settings.

Your choices

You can opt out of text messages at any time by replying STOP, and out of email with the unsubscribe link in any email. You can opt out of website analytics by blocking cookies for this site or by using a tracker-blocking extension.

Patients: your physical-therapy clinic controls your health records. To see, correct, or delete them, contact your clinic. If you contact us instead, we forward your request to your clinic within five business days. For anything else, email us at the address below.

Data retention & security

We keep a clinic's records while it uses HepBuddy. When a clinic deletes a patient, we delete that patient's records, except billing records the clinic must keep for audits. When a clinic's subscription ends, the clinic can export its remote therapeutic monitoring records for 30 days. We then destroy its data within 60 days. We keep only what the law requires, such as billed monitoring records and signed consents and authorizations, which we keep for six years, and anything that cannot feasibly be destroyed. The BAA keeps protecting whatever we keep.

We encrypt data in transit and at rest. Each clinic user has their own login, and access is limited by role. Access to stored data is logged. If a breach affects a clinic's patient data, we tell the clinic within 20 calendar days of discovering it. We keep website analytics data only as long as needed to understand how our pages are used.

Children

HepBuddy is not directed to children under 13, and we do not knowingly collect their information.

Changes

We may update this policy and will revise the date above when we do.

Contact

Questions about this policy? Email harrisonshu@hepbuddy.com.