Patient Privacy

1. Who is responsible for your health information

Your treating podiatry practice is the HIPAA covered entity. That practice decides how your protected health information (PHI) is used and disclosed for treatment, payment, and health-care operations, and it is the practice that owes you a Notice of Privacy Practices (NPP).

PodScribe LLC ("PodScribe," "we") is a Business Associate of the practice. We provide software the practice uses to document visits, communicate with patients, and (when the practice enables them) offer booking, reminders, a portal, and pay links. We handle PHI only on the practice's instructions, under a Business Associate Agreement.

This page is not a Notice of Privacy Practices, and PodScribe does not publish a default NPP on any practice's behalf. Ask your practice for its NPP, or look for it on that practice's booking page, intake, or portal when those surfaces are enabled and the practice has uploaded one.

2. What this page covers (and what it does not)

This page describes how PodScribe, as vendor, handles data when you interact with a practice through PodScribe-hosted patient surfaces (booking, portal, pay links, and practice-to-patient messages).

The Privacy Policy at /privacy is the staff and customer policy. It covers visitors to this marketing site and practices (and their staff) who use the PodScribe platform. If you are a patient, start here; if you are a clinician or staff member using PodScribe, start there.

3. Information a practice may collect through PodScribe

Depending on which features the practice has enabled, the practice may collect, and PodScribe may store on the practice's behalf:

• Identity and contact details you submit (name, date of birth, mobile number, email, and similar fields on a booking or intake form);
• Appointment requests and confirmed visit times;
• Consent and communication preferences, including SMS opt-in and opt-out;
• Portal account and sign-in activity, if the practice offers a portal;
• Payment-related records when you pay the practice through a pay link (see Patient Payments).

PodScribe does not use patient information to market PodScribe to you. We do not sell patient lists.

4. SMS consent (carrier-required)

If you opt in to texts from a practice, that opt-in is with the practice, not with a PodScribe marketing list. Program details, frequency, HELP, and STOP are on the SMS Terms page.

Text messaging originator opt-in data and consent will not be shared with third parties or affiliates for marketing purposes.

5. How PodScribe uses and shares patient data

We use patient data to provide the services the practice has enabled: to host the booking or portal page, to send the practice's messages, to keep security, audit, and support records the law and our BAA require, and to hand a pay-link checkout to the practice's own merchant account when pay links are enabled.

We share patient data with:

• The treating practice (it is their patient record);
• Infrastructure vendors under a Business Associate Agreement where HIPAA requires one (Microsoft Azure hosts the Platform);
• A telecommunications carrier, when the practice has enabled SMS, solely to deliver the practice's messages;
• Stripe, when the practice has enabled pay links, solely as the practice's payment processor on the practice's connected account (PodScribe is not the merchant);
• Authorities when the law requires it.

We do not share originator opt-in data or consent with third parties or affiliates for marketing purposes.

6. Requests about your information

Requests to access, amend, or restrict your health information, or to obtain the practice's NPP, should go to your practice. PodScribe cannot act as your covered entity and will typically route patient privacy requests to the practice that holds the chart.

Vendor/technical questions about this page: support@podiatry-scribe.com.

7. Related pages

• SMS Terms
• Patient Terms
• Patient Payments
• Privacy Policy (staff and customers)
• HIPAA Compliance (how PodScribe runs the platform)
• Data Protection