Privacy Policy

Modality Labs, Inc. ("Modality," "we," "us," or "our") operates the website atwww.modalityehr.com(the "Site") and provides the cloud-based platform described in our Terms of Service (the "Services"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices available to you.

The Services include electronic health records (EHR), customer relationship management (CRM), scheduling, billing and revenue cycle management, human resources and timekeeping, communications tools including secure messaging and text messaging, reporting and analytics, third-party integrations, and AI-assisted features branded as Dali.

Our role depends on the information involved. When a healthcare organization uses the Services to store or transmit Protected Health Information (PHI), that organization is the covered entity and Modality acts as its business associate under a Business Associate Agreement (BAA). We handle PHI according to that agreement and HIPAA, and the covered entity's own notice of privacy practices governs how patient information is used. For information collected through the Site, from prospective customers, and from our own account holders, Modality acts as the controller of that information and this Policy applies directly.

We collect the following categories of information:

• Information you provide.Name, business email address, phone number, job title, professional credentials, billing and payment details, support requests, and messages you send us.
• Customer content.Data your organization enters into the Services, including patient demographics, clinical documentation, insurance and claims data, schedules, employee and timekeeping records, expenses and receipts, and uploaded files. This category often contains PHI.
• Automatically collected information.IP address, browser and device type, operating system, pages viewed, feature usage, timestamps, and diagnostic logs. Cookies and similar technologies are described in Section 12.
• Information from third parties.Data returned by integrations your organization connects, such as insurance eligibility responses, claim status, message delivery receipts, payment confirmations, and accounting records synced from QuickBooks Online.

We use information for the following purposes:

• Providing, operating, maintaining, and supporting the Services
• Authenticating users, enforcing access controls, and keeping audit records of activity
• Processing subscription fees, usage-based charges, and payments, and managing accounts
• Sending transactional and service messages such as appointment reminders, care coordination notices, system alerts, and account notifications
• Delivering integrations your organization has enabled, including eligibility checks, claims submission, messaging, and accounting sync
• Diagnosing problems, monitoring performance, preventing fraud and abuse, and improving reliability and security
• Meeting legal, regulatory, and contractual obligations, including obligations under HIPAA and executed Business Associate Agreements

We do not use PHI for advertising, and we do not sell personal information.

We share information only in the following circumstances:

• With the customer organization whose account the information belongs to, and with the users that organization authorizes
• With service providers and subprocessors listed in Section 6, under contracts that limit their use of the information to providing services to us
• With third-party systems your organization directs us to connect, for the purposes you authorize
• To comply with law, legal process, or a government request, or to protect the rights, property, or safety of Modality, our customers, or the public
• In connection with a merger, acquisition, financing, or sale of assets, subject to the same protections described in this Policy
• With your consent or at your direction

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

We rely on a limited set of vendors to run the Services. Vendors that handle PHI operate under a Business Associate Agreement with Modality. Current subprocessors include:

• Amazon Web Services (AWS).Application hosting, databases, file storage, backups, and access to AI models through Amazon Bedrock.
• Twilio and GoTo.Delivery of SMS, MMS, and voice communications.
• Availity. Insurance eligibility verification and claims transactions with payers.
• Intuit QuickBooks Online.Accounting sync for customers that connect a QuickBooks company, as described in Section 7.
• Payment processors.Handling of subscription and card payments. Modality does not store full card numbers.
• Analytics providers.Aggregate Site and product usage measurement. Analytics are not applied to clinical records.

Each third party handles information under its own privacy policy for its own operations. We may add, change, or discontinue vendors over time; material changes affecting PHI are handled under the applicable Business Associate Agreement.

Modality may de-identify information entered into the Services in accordance with HIPAA's de-identification standard. De-identified data no longer identifies any patient or individual and is no longer Protected Health Information.

We may use de-identified and aggregated data to operate, maintain, and improve the Services, including developing new features, producing analytics and benchmarks, and training the models behind the Services' AI features. Identifiable PHI is never used for these purposes except as permitted by the Business Associate Agreement and applicable law.

Modality and the treatment facilities using the Modality platform may send SMS text messages related to your inquiry, account, admissions process, appointments, treatment notifications, and care coordination. Messages are sent only after you provide express opt-in consent, and consent to receive SMS messages is never a condition of treatment, service, or use of the platform.

We send transactional email related to your account, security, billing, and use of the Services. These messages are part of the Services and cannot be turned off while your account is active. Marketing email is sent only with consent and includes an unsubscribe link in every message. Voice calls placed through the Services may be logged, and recordings are made only where your organization has enabled recording and provided any legally required notice or consent.

We use cookies and similar technologies on the Site and in the application. Strictly necessary cookies support sign-in, session security, and core functionality, and cannot be disabled. Analytics and marketing cookies are set only after you accept them through our cookie banner.

You can change your cookie choices at any time through the banner or your browser settings. We do not use cookies inside patient charts to profile individuals, and we do not respond to browser Do Not Track signals because no common standard exists. Opt-out preference signals recognized under California law are honored as described in Section 17.

We keep information for as long as it is needed for the purpose it was collected, and then delete it or de-identify it. Specific periods depend on the type of data:

• Customer content, including PHI, is retained for the term of your subscription and handled after termination as described in the Data Ownership section of our Terms of Service, which keeps a records package available for sixty (60) days after termination
• Billing and financial records are retained as required by tax, accounting, and audit obligations
• Security and audit logs are retained for the period required by HIPAA and our internal security program
• Messaging consent records are retained for as long as needed to honor your choices and demonstrate compliance
• QuickBooks access and refresh tokens are deleted when the integration is disconnected
• Marketing and Site contact information is retained until you ask us to delete it

We maintain administrative, physical, and technical safeguards appropriate to the sensitivity of the information we handle, including:

• Encryption of data in transit and at rest
• Role-based access controls so users see only the information their role requires
• Audit logs of access to and changes made within patient records
• Automatic logout after fifteen (15) minutes of inactivity, with a warning before the session ends
• Multi-factor authentication options, password requirements, and session controls
• Network isolation, monitoring, vulnerability management, and regular backups
• Workforce training and background screening for personnel with data access

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Report a suspected security issue toprivacy@modalityehr.com.

If we discover a breach of unsecured Protected Health Information, we notify the affected customer organization without unreasonable delay and within the timeframe required by the HIPAA Breach Notification Rule and the applicable Business Associate Agreement. Our notice includes the information the covered entity needs to meet its own notification duties, such as the individuals involved, what happened, and the steps we have taken. For personal information that is not PHI, we provide notice to affected individuals and regulators as required by applicable state breach notification laws.

Depending on where you live and the information involved, you may:

• Request access to the personal information we hold about you
• Request correction of information that is inaccurate or incomplete
• Request deletion of your personal information, subject to legal and contractual retention requirements
• Request a portable copy of information you provided to us
• Withdraw consent for SMS, marketing email, or non-essential cookies
• Object to or restrict certain processing, where applicable law provides it

Submit a request toprivacy@modalityehr.com. We verify requests before acting on them and respond within the time allowed by applicable law. We do not discriminate against anyone for exercising these rights.

For requests about medical records, contact your healthcare provider. As a business associate we route those requests to the covered entity that controls the records and assist that organization in responding.

California residents have rights under the California Consumer Privacy Act as amended by the CPRA, including the right to know what personal information we collect and how we use and disclose it, the right to correct inaccurate information, the right to delete personal information, the right to opt out of the sale or sharing of personal information, the right to limit the use of sensitive personal information, and the right to be free from retaliation for exercising these rights.

Modality does not sell personal information and does not share it for cross-context behavioral advertising. Medical information governed by HIPAA is exempt from the CCPA and is handled under HIPAA and our Business Associate Agreements. You may still confirm and record your preferences on the pages below.

• Your Privacy Choicesfor do not sell or share requests
• Limit the Use of My Sensitive Personal Informationfor limitation requests

An authorized agent may submit a request on your behalf with proof of authorization. Residents of other states with comparable privacy laws may use the same contacts and pages to exercise equivalent rights.

The Site and the Services are intended for use by healthcare organizations and their staff and are not directed to individuals under 18. We do not knowingly collect personal information directly from individuals under 18 through the Site. Where a customer organization enters records about a minor patient into the Services, that information is PHI held on behalf of the covered entity and is governed by HIPAA and the applicable Business Associate Agreement rather than by direct collection from the minor. If you believe a minor has provided us information directly, contactprivacy@modalityehr.comand we will delete it.

The Services are hosted in the United States, and customer content including PHI is stored in United States data center regions. If you access the Services from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your location. Where a transfer of personal information out of another jurisdiction is required, we use appropriate safeguards such as Standard Contractual Clauses.

This Policy is governed by the laws of the State of Delaware, without regard to its conflict of law provisions, and disputes relating to it are resolved under the Governing Law and Arbitration section of our Terms of Service. Nothing in this Policy limits any right you have to contact a regulator, including the U.S. Department of Health and Human Services Office for Civil Rights or your state attorney general.

We may update this Policy from time to time. The date at the top of the page shows when it was last revised. For material changes we provide notice at least thirty (30) days before the change takes effect, by email or in-application notice. Continued use of the Site or the Services after the effective date means you accept the updated Policy. Changes do not reduce the obligations we owe under an executed Business Associate Agreement.

Privacy questions and requests may be sent toprivacy@modalityehr.comor submitted through the contact form below.