Privacy Policy & HIPAA Data Protection Notice

1 Scope & Dual Role (HIPAA Business Associate vs. Data Controller)

PracticeForceOne provides cloud-hosted Electronic Health Record (EHR), Patient Portal, Configurable Forms (CF), Point-of-Sale (POS), Membership Wallet, and Clinical Interoperability software to healthcare providers, aesthetic medical spas, wellness clinics, and senior-living care continuums (each a “Customer Practice”).

2 Categories of Information We Collect

2.1 Patient & Clinical Information (Processed on Behalf of Customer Practices)

• Legal Identity & Demographics: Legal first/last name (including mononym support), date of birth, last four digits of Social Security Number (ssn_last_four), residential address, home and work telephone numbers, email address, and emergency contact / legal guardian details.
• Clinical Intake, Records & Consents: Medical and cosmetic treatment history, allergies (including NKDA attestations), safety screenings, vital signs, clinical encounter documentation, anatomical injection/device dose mappings, and cryptographically signed electronic consent packets.
• Standardized Clinical Photography: Before, After, and Follow-up clinical photographs captured or uploaded into the patient chart, together with associated metadata (capture angle, expression, device parameters, and marketing release status).
• Prescriptions & Clinical Orders: Electronic prescription records and pharmacy routing data transmitted via the Weno Exchange eRx network, lab orders, and device telemetry logs.

2.2 Financial, Membership & Point-of-Sale (POS) Data

• PCI-DSS Tokenized Payments: Self-pay quotes, VIP membership recurring billing, CareCredit/HSA/FSA tenders, and retail POS transactions are processed directly through PCI-DSS Level 1 certified payment infrastructure (Stripe). PracticeForceOne stores only non-sensitive payment tokens, card brand/last-four digits, and invoice ledger receipts—never raw primary account numbers (PAN) or CVV security codes.

2.3 Security, Authentication & Technical Telemetry

• Authentication & Audit Metadata: User identifiers, role-based access control (RBAC) permissions, WebAuthn/FIDO2 passkey public keys, IP addresses, browser user-agent strings, and timestamped access logs required for HIPAA Security Rule compliance (45 CFR § 164.312) and ONC Health IT auditing (45 CFR § 170.315(d)(2)).

3 SMS / Text Messaging & A2P 10DLC Privacy Policy

PracticeForceOne enables Customer Practices to send transactional, clinical, and appointment-related notifications (such as email/account confirmation codes, appointment reminders, pre-visit intake links, and two-factor authentication codes) to patients and authorized users who have explicitly opted in to receive communications.

• Opt-In Consent: Patients and users provide explicit consent to receive transactional messages during portal registration, appointment scheduling, or check-in. Consent to receive SMS messages is never a condition of receiving emergency medical care or purchasing goods/services.
• Opt-Out & Help Commands: You may opt out of SMS messages at any time by replying STOP, UNSUBSCRIBE, or CANCEL to any message, or by updating your communication preferences in the Patient Portal. Reply HELP for assistance.
• Message Frequency & Rates: Message frequency varies based on your scheduled appointments and account activity. Standard message and data rates may apply from your wireless carrier.

4 How We Use Information & Zero-Sale Guarantee

PracticeForceOne uses collected information strictly to deliver, secure, and support the healthcare and practice operations requested by our Customer Practices and their patients:

• Healthcare Operations & Treatment Delivery: Rendering patient charts, running clinical decision support and safety screening rules (OmniGuard™ / SafeScore™), routing e-prescriptions, managing rooming/Kanban workflows, and processing patient checkouts.
• Security, Compliance & Fraud Prevention: Enforcing multi-tenant isolation, verifying user identity, detecting anomalous access patterns, and maintaining immutable cryptographic audit trails.
• Zero Sale of Personal or Health Data: PracticeForceOne never sells, rents, trades, or monetizes Personal Information or Protected Health Information (ePHI) to data brokers, advertisers, or third parties under any circumstances.
• Permitted Subprocessors & Service Providers: We disclose data only to vetted, HIPAA-compliant infrastructure subprocessors (such as Google Cloud Platform for encrypted cloud hosting and database storage, Stripe for PCI-DSS payment processing, and Weno Exchange for electronic prescribing) bound by written confidentiality and security obligations.

5 Clinical Photography, HIPAA Eye-Bar & AI Governance

• Medical Chart Isolation by Default: All clinical photographs captured via the PracticeForceOne 5-Angle Ghost Studio or uploaded into an encounter are encrypted and restricted to the patient’s confidential medical record by default (marketingEligible = false).
• Separate Marketing Authorization Required: No patient photograph is ever marked eligible for clinic portfolio or external marketing use unless the patient has executed a separate, explicit HIPAA Media & Photography Release, which may be revoked by the patient at any time.
• HIPAA De-Identification Controls: PracticeForceOne provides built-in periorbital eye-bar masking and clinical watermarking tools to support de-identification standards under 45 CFR § 164.514(b).
• No Public AI Model Training on ePHI: PracticeForceOne never uses patient medical records, clinical notes, or patient photographs to train public, third-party, or commercial foundation artificial intelligence models.

6 Encryption, Multi-Tenant Isolation & Cryptographic Audit Ledger

PracticeForceOne is engineered to federal health IT security specifications under 45 CFR § 170.315(d)(1)–(d)(13) and the HIPAA Security Rule (45 CFR § 164.308–164.312):

• Encryption in Transit & At Rest: All network traffic is encrypted via TLS 1.3 with strict HTTP Strict Transport Security (HSTS). All databases, backups, and clinical media are encrypted at rest using FIPS 140-3 validated AES-256 encryption.
• Strict Multi-Tenant Practice Isolation: Every database record, API endpoint, and search query is cryptographically scoped to the authenticated practice tenant (practice_id). Cross-tenant access attempts are blocked and logged automatically.
• Tamper-Evident SHA-256 Audit Ledger: Every view, creation, modification, deletion, print, export, or emergency break-glass override of clinical data is recorded in an append-only, SHA-256 hash-chained audit ledger.

7 HL7® FHIR® R4, SMART on FHIR v2 & Patient-Authorized APIs

In conformance with the 21st Century Cures Act and ONC HTI-1 Final Rule (45 CFR § 170.315(g)(10)), PracticeForceOne supports standardized HL7® FHIR® R4 (`US Core 6.1.0` / `USCDI v3`) and SMART App Launch v2.0.0 APIs:

• Patient-Directed Access: Patients may authorize third-party health applications of their choice to retrieve their longitudinal health records using OAuth 2.0 with PKCE and granular SMART v2 scopes (patient/*.rs).
• Third-Party App Responsibility: Once you authorize a third-party application to receive your health data via the SMART on FHIR API, that third-party application’s use of your data is governed by that application’s own privacy policy. You may revoke third-party application tokens at any time through your Patient Portal or clinic administrator.

8 Your Privacy Rights, Data Retention & State Disclosures

• HIPAA Patient Rights: Under HIPAA, patients have the right to inspect and obtain an electronic copy of their designated record set, request corrections/addendums to their chart, receive an accounting of disclosures, request restrictions on certain uses, and revoke authorizations (including marketing photo releases). Because PracticeForceOne operates as a Business Associate to your healthcare provider, requests regarding your clinical medical record should be submitted directly to your treating clinic or via your PracticeForceOne Patient Portal.
• U.S. State Privacy Laws (CCPA/CPRA, VCDPA, CPA, CTDPA, TDPSA): To the extent personal information is collected outside the HIPAA/medical-record exemption, residents of applicable states have the right to request access to, correction of, or deletion of their personal information, and to opt out of targeted advertising or data sales (note: PracticeForceOne does not sell personal information or engage in cross-context behavioral advertising).
• Data Retention: Clinical records and audit logs are retained in accordance with applicable federal and state medical record retention laws (typically 6 to 10+ years for adult records and statutory minor retention periods) and the instructions of the governing Customer Practice.
• Cookies & Session Storage: PracticeForceOne uses strictly necessary first-party session tokens and security cookies required for authentication, CSRF protection, and clinic session continuity. We do not embed third-party ad-network tracking pixels inside the EHR or Patient Portal.

9 Chief Privacy Officer & Contact Information

If you have questions about this Privacy Policy, our HIPAA Business Associate security posture, ONC conformance receipts, or wish to exercise a privacy right, please contact our Privacy & Security Office: