Privacy policy

1. HIPAA and legal compliance

LogicNerve is committed to complying with all HIPAA regulations applicable to its activities, including the Privacy, Security, and Breach Notification Rules. This commitment includes applicable HITECH Act requirements and other federal and state privacy, data-security, and breach-notification laws.

Our policy requires adherence to the privacy and security obligations, policies, procedures, and contractual protections required by applicable law. No provision of this Policy permits a use or disclosure that applicable law prohibits.

Where LogicNerve handles protected health information (“PHI”) for a covered entity or another business associate, its business associate obligations govern that processing. A written Business Associate Agreement (“BAA”) and the required safeguards must be in place before PHI is processed in that capacity.

Development, demonstration, and evaluation environments must use synthetic or properly de-identified information unless expressly approved for PHI under the applicable agreements and safeguards. This Policy does not itself establish a BAA or represent a government certification of the Services.

The requirements that apply depend on the information, the parties’ legal roles, and the relevant jurisdiction. Where applicable law or a BAA provides greater protection, that protection controls.

2. Our role and the Customer’s responsibilities

LogicNerve provides software that supports healthcare administrative workflows. Customers determine which records, systems, and users participate, and remain responsible for their clinical decisions, authorized disclosures, and recordkeeping obligations.

For information processed on a Customer’s behalf, we act under its authorized instructions, the service agreement, and any applicable BAA. We do not acquire an independent right to use patient information merely because it passes through the Services.

This Policy is not the Customer’s HIPAA Notice of Privacy Practices and does not replace that notice. Patients should consult their healthcare organization’s notice for its treatment, payment, healthcare operations, and individual-rights practices.

3. Categories and sources of information

The information processed depends on the features enabled and the records the Customer authorizes. Information can come from authorized users, uploaded documents, connected clinical or administrative systems, and service interactions.

• Patient and clinical information: Patient identifiers, contact details, demographics, diagnoses, medications, orders, clinical notes, supporting documentation, and information relevant to a requested service.
• Coverage and authorization information: Insurance and member identifiers, payer details, benefits, procedure and diagnosis codes, service dates, authorization requests, determinations, and correspondence.
• Professional and organizational information: Staff names, professional identifiers, work contact details, organization membership, roles, and workspace permissions.
• Connected-account information: Account identifiers, permissions, authorization credentials, connection status, and content necessary for the connected workflow, including sign-in verification messages.
• Workflow and support information: Tasks, annotations, record changes, user instructions, generated work products, support requests, and associated correspondence.
• Technical and security information: Device and browser information, network addresses, timestamps, access events, errors, and workflow execution records. Execution records can contain information displayed or processed during the authorized workflow.

Not all information in these categories is PHI. Its legal status depends on its content and the circumstances in which it is maintained or transmitted.

4. Purposes of processing

We process information to provide the functionality requested by the Customer and its authorized users. This includes organizing cases, retrieving source information, preparing authorization materials, identifying missing requirements, and maintaining workflow status and history.

We also process information to authenticate users, enforce organizational permissions, maintain integrations, provide support, investigate errors, protect security, and satisfy legal obligations. Processing of PHI for these purposes remains subject to the applicable BAA and law.

Our policy restricts access, use, and disclosure to information reasonably necessary for the authorized purpose, consistent with applicable minimum-necessary requirements. A request to perform a workflow does not authorize unrelated use of the underlying patient information.

5. Permitted disclosures and service providers

Information may be made available to authorized members of the Customer’s organization and to recipients involved in its requested workflow. The Customer’s permissions and instructions govern these disclosures, subject to applicable law.

We use service providers for infrastructure, storage, authentication, integrations, communications, security, and computational processing. Our policy requires confidentiality, purpose limitations, and appropriate contractual safeguards for providers that process information on our behalf.

Where a subcontractor creates, receives, maintains, or transmits PHI on our behalf, the required business associate protections must apply. Providers are not authorized to use that PHI for their own unrelated purposes.

Disclosures for legal process, regulatory oversight, security investigations, or corporate transactions require an applicable legal basis. A corporate transaction does not remove confidentiality obligations or permit a prohibited transfer of PHI.

We do not sell PHI or use it for targeted advertising. Any use or disclosure requiring a separate authorization must have that authorization before it occurs.

6. Automated processing and artificial intelligence

The Services can use automated processing, including artificial intelligence, to extract and organize information, prepare draft work, and assist with authorized workflows. These processes can involve service providers operating on our behalf.

Our policy requires this processing to remain within the Customer’s authorized purpose and the applicable contractual and legal restrictions. PHI must not be used to train general-purpose models under an authorization limited to providing the Customer’s workflow.

Generated information can be incomplete or inaccurate. Authorized professionals remain responsible for reviewing outputs and making clinical, coverage, and submission decisions. This Policy does not authorize automated decisions outside the scope of the Customer’s instructions.

7. Connected accounts and email

Users can authorize connections to external accounts for an organizational workflow. Requested permissions and connection controls describe the access involved. Connections can remain available to authorized organization members until disconnected or revoked.

Email integration can identify a mailbox, retrieve sign-in verification messages, and update the labels or read status of accepted messages. Disconnecting stops future access through that connection but does not reverse completed actions or delete source records.

The Connected-account Privacy Supplement explains the specific email permissions, data handling, and additional restrictions. It forms part of this Policy and controls where it imposes stricter limits on connected-account data.

8. Security and confidentiality requirements

Our policy requires administrative, physical, and technical safeguards appropriate to the sensitivity of the information and the risks involved. For electronic PHI, those safeguards must address applicable HIPAA Security Rule requirements.

These requirements include risk assessment and management, authorized access, workforce confidentiality and training, activity review, incident response, and continuity planning. Technical protections must address authentication, transmission security, storage protection, and separation of organizational access.

Safeguards require ongoing evaluation; no system eliminates every security risk. Customers and users must protect credentials, assign appropriate permissions, secure their devices, and promptly report suspected unauthorized access.

9. Security incidents and breach notification

Our policy requires investigation of suspected security incidents, mitigation of harmful effects, and documentation of the response. Reportable incidents and breaches require notice to the appropriate Customer and other recipients as required by law and contract.

Where LogicNerve acts as a business associate, notification and cooperation obligations are governed by HIPAA and the BAA. Notification to affected individuals, regulators, or other parties depends on the applicable legal requirements and allocation of responsibilities.

Applicable non-HIPAA health-data breach rules and state notification laws can impose additional obligations. We will follow the notification requirements and deadlines that apply to the incident.

10. Retention, return, and deletion

Retention depends on the record category, the Customer’s instructions, the service agreement, and applicable legal requirements. Relevant factors include active workflows, required records, security investigations, disputes, and legal preservation obligations.

Disconnecting an integration, archiving a case, or closing a user account does not necessarily delete associated organizational records. A deletion request must account for the Customer’s authority over the records and any applicable retention obligations.

At the end of an applicable BAA, PHI must be returned or destroyed as required by that agreement and law. If return or destruction is infeasible, continuing protections and restrictions apply to retained PHI.

Backup copies and legally retained records can remain after deletion from active systems. Such retention does not authorize renewed use for unrelated purposes. Contact us to request the retention terms applicable to your organization or a particular record.

11. Individual rights and requests

Depending on applicable law and the information involved, individuals can have rights to access, receive copies of, correct, or request deletion of personal information. Other rights can include restrictions, confidential communications, an accounting of certain disclosures, withdrawal of consent, or an appeal.

These rights are subject to statutory conditions and exceptions. HIPAA does not create a general right to erase medical records. Withdrawal of consent does not invalidate prior lawful processing or override required retention.

For patient records controlled by a Customer, direct your request to that healthcare organization. We will assist the Customer as required by the BAA and applicable law. A request sent to us can be referred to the organization responsible for responding.

For information we control directly, contact us using the details below. We may request proportionate identity or authority verification before disclosing or changing information. An authorized representative must provide the documentation required for the request.

You can raise privacy concerns without retaliation and complain to the regulator responsible for your rights. HIPAA complaints can be submitted to the U.S. Department of Health and Human Services, Office for Civil Rights.

12. State laws and specially protected records

Applicable state privacy, consumer-health-data, confidentiality, and medical-record laws can provide additional protections. Certain records can also be subject to heightened federal restrictions, including substance-use-disorder records where the relevant rules apply.

Our policy requires compliance with applicable consent, disclosure, and use limitations for these records. Neither this Policy nor a general account permission overrides a legally required authorization or other condition on processing.

Where a separate jurisdiction-specific notice or consent is required, it must be provided before the relevant processing. Rights and exemptions depend on the law, the data, and the circumstances; they are not identical for all users.

13. Children and dependent patients

The Services are intended for authorized professional and organizational users, rather than direct use by children. Customers can process pediatric or dependent-patient information where they have the required authority.

Access by parents, guardians, and other representatives remains subject to applicable confidentiality rules and the healthcare organization’s responsibilities. A professional account does not itself establish authority to disclose a minor’s records.

14. Website communications and technical data

Separate from patient workflows, we process business contact information supplied for inquiries, demonstrations, and support. Public websites can use cookies, analytics, and advertising measurement, subject to applicable notice and consent requirements.

Those website activities do not authorize disclosure of PHI to advertising or visitor-identification services. Do not submit patient records through public inquiry forms or ordinary support email. Request an approved channel for sensitive information.

Essential application cookies and technical records support authentication, session management, preferences, and security. Customer-controlled systems and external websites have their own privacy practices, which this Policy does not replace.

15. Changes and governing protections

We may update this Policy to reflect changes in the Services, processing practices, or legal requirements. The date above identifies the effective version. Material changes require any notice or consent mandated by applicable law or agreement.

An update does not retroactively authorize a prohibited use of PHI or expand the rights granted by a BAA. Mandatory law and the applicable BAA control in the event of a conflict concerning PHI.

16. Privacy contact

Send privacy questions, rights requests, or reports of suspected unauthorized use to hamza@logicnerve.com, with “Privacy” in the subject line.

Include your contact details, the organization involved, and a description of the request. Do not include medical records, passwords, or verification codes in the initial message. We will arrange an appropriate channel where sensitive information is necessary.