Privacy Policy

1. Information We Collect

We may collect the following categories of information:

• Account & Contact Information — Name, email address, phone number, organization, role or job title, product interest, and any message you provide when you request a demo, ask about a pilot, create an account, or contact us.
• Protected Health Information (PHI) — Cardiac imaging data and related clinical information processed on behalf of our healthcare customers under a Business Associate Agreement.
• Usage Data — Log data, device information, IP address, browser type, and interactions with our products and website collected automatically.
• Cookies & Analytics — We use cookies and similar technologies to understand how visitors use our website and to improve our services.

2. How We Use Your Information

• To provide, operate, and improve our products and services
• To process and analyze cardiac imaging data on behalf of our healthcare customers, and to develop, validate, and improve our algorithms using data that has been de-identified in accordance with HIPAA
• To communicate with you about your account, demos, or inquiries
• To send product updates and relevant information (you may opt out at any time)
• To comply with legal obligations and enforce our agreements
• To monitor and improve the security and performance of our platform

3. How We Share Your Information

We do not sell your personal information. We may share information with:

• Service Providers — Third-party vendors who assist in operating our platform (e.g., cloud hosting, analytics), bound by confidentiality and data protection obligations.
• Healthcare Customers — PHI is processed on behalf of and returned to the covered entity that provided it.
• Legal Requirements — When required by law, regulation, or legal process, or to protect the rights, safety, or property of Heartvue, our customers, or the public.
• Business Transfers — In connection with a merger, acquisition, or sale of assets, with notice provided to affected parties.

4. Data Security

We implement industry-standard technical and organizational measures to protect your information, including encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, network isolation, audit logging, and continuous monitoring, and we maintain a SOC 2 security program. Information is stored and processed in the United States. No method of transmission or storage is completely secure; if we become aware of a security incident affecting your information, we will notify affected customers and individuals as required by law and by our Business Associate Agreements.

5. Data Retention

We retain personal information only as long as necessary to fulfill the purposes described in this policy or as required by law. PHI is retained in accordance with our Business Associate Agreements and applicable regulations. Data is securely deleted upon contract termination or request.

6. HIPAA & Protected Health Information

When Heartvue processes PHI on behalf of a covered entity, we do so under the terms of an executed Business Associate Agreement and in compliance with the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule. PHI is used solely to provide the contracted services, is accessed only by authorized personnel who need it to perform those services, and is never sold or used for marketing purposes. Where permitted by the applicable Business Associate Agreement, we de-identify data in accordance with 45 CFR § 164.514; de-identified data is no longer PHI, and we use it to develop, validate, and improve our algorithms and services. We do not attempt to re-identify de-identified data. Individuals seeking to exercise HIPAA rights over their PHI should contact the healthcare provider that holds their records; we will support our customers in responding to those requests.

7. Your Rights

Depending on your jurisdiction (including California and other U.S. states with comprehensive privacy laws, and the EEA or UK), you may have the right to:

• Access, correct, or delete your personal information
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent
• Request a portable copy of your data
• Opt out of marketing communications

To exercise any of these rights, contact us at privacy@heartvue.ai. We may need to verify your identity before acting on a request, and we will not discriminate against you for exercising your rights. We do not sell personal information or share it for cross-context behavioral advertising.

8. Cookies

Our website uses cookies and similar technologies for analytics, functionality, and performance. We do not use cookies for targeted advertising. You can manage or disable cookies through your browser settings; disabling cookies may affect your experience on our site.

9. Third-Party Links

Our website or products may contain links to third-party sites. We are not responsible for the privacy practices of those sites and encourage you to review their policies.

10. Children's Privacy

Our website and services are intended for healthcare organizations and professionals and are not directed at individuals under the age of 18. We do not knowingly collect personal information from children; if you believe a child has provided us personal information, contact us and we will delete it.

11. Changes to This Policy

We may update this policy from time to time. We will post the revised version on this page with an updated "Last updated" date. Material changes will be communicated through our website or by email to affected customers before they take effect.

Questions About Privacy?

Reach out to our team for any privacy-related inquiries or data requests: privacy@heartvue.ai