Get in touch

Privacy Policy

HealthyMe AI Company · Effective Date: April 7, 2026 · Last Updated: April 7, 2026

1. Who We Are

HealthyMe AI Company ("HealthyMe AI Company," "we," "our," or "us") is a healthcare technology company incorporated in the State of Delaware. We provide software services to medical practices and operate as a Business Associate (as defined under the Health Insurance Portability and Accountability Act of 1996, as amended, "HIPAA") to those practices.

This Privacy Policy governs our collection, use, disclosure, and protection of information when you interact with our patient-facing services, including pre-visit questionnaire forms delivered via SMS link on behalf of your healthcare provider ("Services").

Note: This Privacy Policy governs HealthyMe AI Company's practices as a technology vendor. It does not replace or supersede your healthcare provider's own HIPAA Notice of Privacy Practices, which governs how your provider uses and discloses your protected health information (PHI). Please contact your provider directly for a copy of their Notice of Privacy Practices.

2. Scope

This Policy applies to:

  • Pre-visit patient questionnaire forms accessed via SMS link
  • HealthyMe AI Company's patient-facing web properties at healthyme.io and associated subdomains
  • Any communications you receive from HealthyMe AI Company on behalf of your healthcare provider

This Policy does not apply to information collected by your healthcare provider through its own systems or to third-party websites linked from our Services.

3. Information We Collect

3.1 Information You Provide Directly

  • Responses to clinical questionnaire questions (e.g., advance care plan status, tobacco use status, symptom scores)
  • Date and time of form submission

3.2 Information Collected Automatically

When you access our Services, we automatically collect:

  • IP address (used solely for security, fraud prevention, and regulatory compliance)
  • Device type, operating system, and browser type
  • Form access timestamp and completion status
  • Referring URL (the link that brought you to the form)

3.3 Cookies and Tracking Technologies

Our patient-facing forms use strictly necessary session cookies only to maintain form state during a single session. We do not use advertising cookies, cross-site tracking pixels, or behavioral analytics on patient forms. We do not respond to "Do Not Track" (DNT) browser signals as no industry standard for DNT compliance currently exists; however, we do not conduct cross-site behavioral tracking.

3.4 Information We Do Not Collect Through SMS or Forms

  • Full legal name, Social Security number, or government-issued ID numbers
  • Payment card or financial account information
  • Biometric identifiers

4. How We Use Your Information

We use information collected solely for the following purposes:

  • Transmitting your responses to your healthcare provider's electronic medical record (EHR) system
  • Enabling your care team to prepare for your visit
  • Supporting your healthcare provider's Medicare quality reporting obligations (including MIPS quality measures)
  • Maintaining the security, integrity, and functionality of the platform
  • Complying with applicable law and legal obligations
  • Investigating and preventing fraud, abuse, or unauthorized access

We do not use your information for marketing, advertising, profiling, or any purpose unrelated to your healthcare visit or our contractual obligations to your provider.

5. How We Share Your Information

We share information only as follows:

5.1 Your Healthcare Provider Your form responses are transmitted to your healthcare provider's EHR system. Your provider is an independent covered entity under HIPAA and their own privacy practices govern further use and disclosure of your information.

5.2 Service Providers (Subprocessors) We engage third-party service providers who process data on our behalf, including cloud infrastructure and SMS delivery providers. All subprocessors are bound by written data processing agreements prohibiting use of your data for their own purposes and requiring appropriate security controls. A list of our current subprocessors is available upon request at contact@healthyme.io.

5.3 Legal and Regulatory Disclosures We may disclose information when required by applicable law, regulation, court order, or lawful governmental request, or when necessary to protect the rights, property, or safety of HealthyMe AI Company, our clients, or others.

5.4 Business Transfers In connection with a merger, acquisition, reorganization, or sale of all or substantially all of our assets, your information may be transferred to the successor entity, subject to the same privacy protections described in this Policy.

5.5 With Your Consent We may share information for other purposes with your explicit prior consent.

We do not sell, rent, or share your personal information with advertisers, data brokers, or any third party for commercial purposes.

6. SMS Messaging and TCPA Compliance

If you receive an SMS from HealthyMe AI Company on behalf of your healthcare provider:

  • Messages are sent only in connection with a scheduled appointment at the requesting provider
  • No protected health information (PHI) is included in any SMS message body — all clinical content is delivered via a secure HTTPS link
  • Message and data rates from your carrier may apply
  • Maximum frequency: One (1) message per scheduled appointment
  • To opt out: Reply STOP to any message. You will receive one confirmation message and no further SMS from that number
  • For assistance: Reply HELP or contact your provider's office directly

By receiving SMS messages through our platform (enabled by your provision of a phone number to your healthcare provider), you consent to receive these appointment-related messages. This consent is not a condition of receiving medical treatment.

7. Data Security

We implement administrative, technical, and physical safeguards to protect your information, including:

  • Encrypted data transmission using TLS 1.2 or higher for all form links and submissions
  • Time-limited, cryptographically signed, single-use secure link tokens
  • Role-based access controls restricting data access to authorized personnel
  • Regular security assessments and vulnerability testing
  • Incident response procedures

No method of electronic transmission or storage is 100% secure. In the event of a data breach affecting your information, we will notify affected individuals and applicable authorities in accordance with applicable state and federal breach notification laws.

8. Data Retention

We retain patient form responses only as long as necessary to:

  • Deliver responses to your healthcare provider's EHR system (typically within 24 hours of submission)
  • Comply with applicable legal and regulatory recordkeeping requirements
  • Resolve disputes and enforce our agreements

We do not maintain long-term independent repositories of patient clinical responses beyond what is required for audit, compliance, and operational continuity purposes. De-identified or aggregated data may be retained indefinitely.

9. Your Privacy Rights

Depending on your state of residence, you may have the following rights with respect to your personal information:

All Users:

  • Right to opt out of SMS communications at any time (reply STOP)
  • Right to request information about data we hold about you

California Residents (CCPA/CPRA):

  • Right to know what personal information we collect, use, disclose, and sell
  • Right to delete personal information (subject to exceptions)
  • Right to correct inaccurate personal information
  • Right to opt out of the sale or sharing of personal information (we do not sell personal information)
  • Right to limit use of sensitive personal information
  • Right to non-discrimination for exercising your privacy rights

Residents of Virginia, Colorado, Connecticut, Texas, and other states with comprehensive privacy laws may have similar rights under applicable state law.

To exercise any of these rights, submit a request to: contact@healthyme.io

We will respond to verifiable requests within the timeframe required by applicable law (generally 45 days, with a possible 45-day extension). We may need to verify your identity before processing your request.

10. Children's Privacy (COPPA)

Our Services are not directed to individuals under the age of 13, and we do not knowingly collect personal information from children under 13 without verifiable parental consent as required by the Children's Online Privacy Protection Act (COPPA). If you believe a child under 13 has submitted information through our platform without parental consent, contact us immediately at contact@healthyme.io and we will take steps to delete such information.

11. International Data Transfers

Our Services are operated in the United States. If you are located outside the United States, please be aware that information you provide may be transferred to, processed, and stored in the United States, where data protection laws may differ from those in your jurisdiction.

12. Third-Party Links

Our SMS messages contain links to HealthyMe AI Company-operated forms. Those forms may contain links to your healthcare provider's website or patient portal. We are not responsible for the privacy practices of third-party websites. We encourage you to review the privacy policy of any site you visit.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be indicated by an updated "Last Updated" date and, where practicable, additional notice. Continued use of our Services following any update constitutes acceptance of the revised policy.

14. Contact Us

HealthyMe AI Company

  • Privacy Inquiries: contact@healthyme.io
  • Legal: contact@healthyme.io
  • Website: healthyme.io

For questions about how your healthcare provider uses or discloses your health information, please contact your provider directly or refer to their HIPAA Notice of Privacy Practices.