Privacy policy
Draft privacy information for Sift.
Organization identity and contact
Health-record and account information collected
Sift may be designed to process account information, user-provided information, technical data, and patient-authorized medical records. [REQUIRED] Publish the verified data inventory, collection points, sensitive-data categories, and whether collection is required or optional.
Connected medical records and processing
Where a patient authorizes a connection, Sift intends to retrieve only information permitted by granted scopes and available source APIs. Intended processing may organize records, preserve source details, create plain-language explanations, and support appointment preparation. [REQUIRED] Verify every production purpose and document authorization and refresh behavior.
Purposes and legal basis
Intended purposes include organizing records, displaying source information, supporting appointment preparation, and providing plain-language assistance. [REQUIRED] Legal counsel must document applicable legal bases and HIPAA role, if any; HIPAA applicability is not presumed.
AI service providers and health information
Storage and other processors
Revoking connected-record access
Retention and deletion
Security practices
Sift intends to use authorization and permission boundaries appropriate to sensitive information. Implemented controls must be verified before they are described as facts.