Privacy Policy

1. Who We Are

CaseFlow ("we," "us," or "our") is an autonomous surgical practice operations platform operated by Polsia, Inc. We provide AI-powered fax processing, referral intake, insurance pre-authorization assistance, and scheduling tools for surgical practices.

This Privacy Policy explains how CaseFlow collects, uses, stores, and protects information — including Protected Health Information (PHI) — in connection with our services.

2. Information We Collect

Protected Health Information (PHI)

When a surgical practice uses CaseFlow to process patient referrals, we may receive and process PHI on their behalf, including:

• Patient names, dates of birth, and contact information
• Insurance IDs, group numbers, and payer information
• Diagnosis codes (ICD-10), procedure codes (CPT), and clinical notes
• Referring physician information and referral documents
• Fax transmissions containing medical records or referral packets
• Pre-authorization requests and responses

This PHI is processed solely on behalf of the covered entity (your practice) in accordance with our Business Associate Agreement.

Practice & Account Information

• Practice name, address, and contact information
• Billing contact name and email address
• Subscription and payment information (processed securely via Stripe)
• User account credentials (hashed passwords, email addresses)

Usage Data

• IP addresses, browser type, and device identifiers
• Pages visited and features used within the platform
• System logs for security and debugging purposes

3. How We Use Your Information

PHI — Permitted Uses Only

We use PHI exclusively to provide services to your practice as described in our BAA. This includes:

• Processing and classifying incoming fax referrals
• Extracting and structuring patient data from documents
• Supporting insurance pre-authorization workflows
• Generating referral intake records in your practice's dashboard

We do not use PHI for advertising, marketing, or any purpose beyond what is permitted under HIPAA and your BAA.

Practice Information

• To provision and manage your account
• To process subscription payments
• To send service notifications and product updates
• To provide customer support

4. Data Storage & Security

Encryption at Rest

All data — including PHI — is encrypted at rest using AES-256 encryption. Our PostgreSQL database is hosted on Neon, a SOC 2 Type II certified cloud database provider.

Encryption in Transit

All data transmitted between your browser or systems and CaseFlow is encrypted using TLS 1.2 or higher (HTTPS). Fax transmissions are received via secure, encrypted channels.

Access Controls

Access to PHI is restricted to authorized CaseFlow personnel and AI systems that require it to perform contracted services. We maintain detailed access logs and conduct regular security reviews.

Infrastructure

Our application is hosted on Render (SOC 2 compliant). Our database is hosted on Neon (SOC 2 Type II). We do not store PHI on consumer-grade storage services.

5. Data Sharing

We do not sell, rent, or trade your data or PHI to third parties.

We may share data only in these limited circumstances:

• AI Processing: PHI may be processed by AI models (including Anthropic Claude) under strict data processing agreements that prohibit training on your data and require HIPAA-compliant handling. This is disclosed in our BAA.
• Infrastructure Subprocessors: Render (hosting), Neon (database), Stripe (payments), and similar vendors under data processing agreements with appropriate safeguards.
• Legal Requirements: When required by law, regulation, or valid legal process.
• Your Direction: When you direct us to share information as part of the service (e.g., exporting a referral to your EMR).

A complete list of our subprocessors is available upon request at caseflow@polsia.app.

6. Data Retention

We retain PHI for the duration of your active subscription plus a configurable retention period (default: 7 years, in accordance with HIPAA minimum retention guidelines). Practices can request shorter or longer retention windows.

Upon subscription termination, you may request deletion of your PHI within 90 days. We will provide a data export upon request before deletion.

7. Your Rights

As a covered entity, your practice retains all rights over PHI under HIPAA. CaseFlow, as your Business Associate, will support you in responding to patient rights requests including:

• Right of access to PHI
• Right to amend PHI
• Right to an accounting of disclosures
• Right to request restrictions on use or disclosure

Contact us at caseflow@polsia.app to initiate any PHI rights request.

8. Breach Notification

In the event of a breach of unsecured PHI, CaseFlow will notify the affected covered entity within 60 calendar days of discovery, in accordance with the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D). Notification will include the nature of the breach, categories of PHI involved, and steps being taken to investigate and mitigate.

9. Cookies & Analytics

Our public marketing website uses minimal analytics (anonymized) to understand how visitors discover CaseFlow. We do not use third-party advertising cookies. No PHI is ever transmitted to analytics providers.

10. Children's Privacy

CaseFlow is a B2B healthcare operations platform intended for use by medical practices and their staff. We do not knowingly collect personal information from children under 13.

11. Changes to This Policy

We may update this Privacy Policy as our services evolve or as regulations change. We will notify active customers of material changes via email at least 30 days before they take effect. The effective date at the top of this page reflects the most recent revision.