Privacy Policy

1. Who We Are

H3X Lite is a clinical AI platform operated by H3X Health (“H3X,” “we,” “our,” or “us”) and accessible at lite.h3x.ai. H3X Lite provides AI-assisted clinical documentation (transcription, SOAP notes, HPI, AI diagnosis), insurance eligibility verification, claims management, and related services for small and midsize healthcare clinics.

2. HIPAA and Protected Health Information

H3X Lite is designed for use by HIPAA-covered entities and their business associates. When you use H3X Lite to document patient encounters or process patient information, H3X Health acts as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA).

• A Business Associate Agreement (BAA) is provided to all subscribing organizations. The BAA governs our handling of Protected Health Information (PHI).
• PHI submitted to H3X Lite (including transcriptions, SOAP notes, patient demographics, and insurance data) is used solely to provide the contracted services and is not sold, shared with third parties for marketing, or used for any purpose beyond service delivery.
• PHI is encrypted at rest (AES-256) and in transit (TLS 1.2+).
• Access to PHI is role-based and logged for audit purposes.

If you have questions about our BAA or HIPAA compliance program, contact us at privacy@h3x.ai.

3. Information We Collect

3a. Account and Organization Data

• Organization name, address, domain, and contact information
• Team member names, email addresses, usernames, and roles
• Billing information (processed via our payment processor; we do not store raw card numbers)
• Login credentials (passwords are hashed and never stored in plain text)

3b. Clinical Data (PHI)

• Patient records including demographics, contact information, and insurance profiles
• Audio recordings and transcriptions of clinical encounters
• AI-generated SOAP notes, HPI narratives, diagnosis suggestions, prior authorization requests
• Eligibility check responses from clearinghouses
• Claims data submitted to payers

3c. Usage and Technical Data

• Log data (IP addresses, browser type, timestamps, pages visited)
• AI credit usage and transaction history
• Error reports and performance metrics

4. How We Use Your Information

• Service delivery: Providing transcription, SOAP note generation, eligibility checks, and claims management features.
• Account management: Managing your subscription, sending invoices, and processing payments.
• Communications: Sending transactional emails (account setup, password resets, billing receipts). We do not send marketing emails without your consent.
• Patient messaging: When you send SMS or email messages to patients through H3X Lite, those messages are transmitted via our third-party communication providers (see Section 5).
• Product improvement: Analyzing aggregated, de-identified usage patterns to improve the platform. PHI is never used to train AI models without explicit written consent.
• Legal compliance: Meeting our obligations under HIPAA, applicable state laws, and court orders.

5. Third-Party Service Providers

We use the following sub-processors to deliver our services. Each is bound by a data processing agreement and, where applicable, a BAA:

We do not sell your data to any third party.

6. Data Retention

• Account and organization data is retained for the duration of your subscription plus 90 days following cancellation, after which it is deleted or de-identified.
• PHI (patient records, transcriptions, clinical notes) is retained per your organization’s retention policy as specified in the BAA, subject to applicable state medical records laws (typically 7–10 years).
• Audit logs are retained for a minimum of 6 years in accordance with HIPAA requirements.
• You may request deletion of your account data at any time by contacting privacy@h3x.ai. PHI deletion requests must follow the process outlined in your BAA.

7. Security

We implement administrative, physical, and technical safeguards to protect your data, including:

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for data at rest
• Role-based access control (RBAC) with audit logging
• Multi-factor authentication (MFA) support
• Regular security assessments and penetration testing
• Breach notification procedures in compliance with HIPAA and applicable state laws

Despite these measures, no system is completely secure. In the event of a breach involving PHI, we will notify affected covered entities within the timeframes required by HIPAA.

8. Cookies and Tracking

H3X Lite uses essential session cookies to maintain your logged-in state. We do not use advertising cookies, cross-site tracking, or third-party analytics cookies. Our public marketing pages may use a minimal analytics service to understand aggregate traffic patterns; no personally identifiable information is collected for marketing purposes.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate account data
• Request deletion of your account (subject to legal retention obligations)
• Opt out of non-essential communications
• Receive a copy of your data in a portable format

For PHI-related rights (patient access, amendment, restriction), covered entities should follow their own HIPAA Notice of Privacy Practices. To exercise your account rights, contact privacy@h3x.ai.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top and, for material changes, notify subscribing organizations by email at least 30 days before the change takes effect. Continued use of H3X Lite after the effective date constitutes acceptance of the revised policy.

11. Contact Us

For privacy-related questions, BAA requests, or data subject rights requests: