Privacy Policy

This policy covers the public marketing website only: the pages served at brihealth.ai. It does not cover any future clinical product, pilot, or deployment, each of which will be governed by its own separate agreements and privacy terms.

The site does not run analytics, carries no advertising or tracking tags, and sets no cookies. The information involved is:

• Pilot-request form. If you submit the "Book a pilot" form, you give us your name, work email, clinic name, role, optionally which EHR you use, and, only if you tick it, your consent to receive occasional updates. You provide all of this voluntarily so we can arrange your pilot and follow up. The form is for business contact details only; please do not enter patient information into it.
• Estimator figures. If you open the form from the reimbursement or time estimator, the figures you set there are sent with your request: for example the number of patients, the enrollment share, the number of providers or physicians, the patient-mix or rate assumptions, prior-authorization hours, and the resulting estimate. These are figures about your practice, not about any patient, and the form shows you a summary of them before you send it. If you open the form any other way, no estimator figures are sent.
• Page preferences. When you choose "Medicare clinic" or "Private clinic", the site stores that choice in your browser's local storage ("bri-clinic-mode") and in the page address ("?clinic=private"), so the page opens the same way next time. Choosing the short or full version on a phone or tablet is not stored at all. These preferences stay on your device and are not sent to us unless you send a pilot request, which then records whether you were viewing the Medicare clinic or Private clinic version of the page. They are not cookies or tracking identifiers, and you can clear them from your browser at any time.
• Interactive preview. The preview on this site runs entirely in your browser, including anything you type into its free-text field. Nothing you enter there is transmitted to us or to anyone else, and nothing is kept once you leave the page.
• Ad-campaign parameters. If you arrive from an ad or a tagged link, the web address you land on may carry campaign tags (for example a Google click identifier, or "utm_" values naming the campaign). The site keeps them in your browser for the current tab only, and includes them with your pilot request if you choose to send one, so we can tell which campaign a request came from. They are not cookies, are never used to build a profile of you, and are discarded when you close the tab.
• Technical data. Like any website, our host's servers process technical request data, such as your IP address, browser type and the pages requested, in standard access logs used to deliver and secure the site.

We collect all of this directly from you or your browser, and none of it from data brokers or other companies. We do not collect protected health information through this site, and neither the form, the estimator nor the preview is intended for it. We do not knowingly collect sensitive personal information.

We rely on a small number of third-party providers ("processors") to run the site. Each receives only what it needs:

• Web3Forms: handles pilot-request submissions. It is operated by Web3Creative, based in India, and it is not a pure pass-through: it stores each submission on Amazon Web Services infrastructure in the United States for up to three years, after which the submission is deleted automatically. Its spam-filtering sub-processors, CleanTalk and Akismet, receive your IP address and email address. Its data-processing terms are published at web3forms.com/dpa, and transfers out of the EEA or UK are covered by the European Commission's Standard Contractual Clauses.
• Amazon Web Services: hosts this website. As with any web host, its servers process technical request data such as IP addresses in standard access logs.
• Microsoft 365, our email provider, receives the copy of your submission that arrives in our inbox, and carries any reply we send you.

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not share it with anyone else for their own marketing. We may disclose information if the law requires it, to protect our rights or the safety of others, or as part of a merger, acquisition or sale of assets, in which case this policy would continue to apply to it.

• To respond to your pilot request, arrange a call, and prepare for it (including the estimate you sent).
• To send occasional updates, only if you ticked the box, until you unsubscribe.
• To see which of our ad campaigns a request came from, using the campaign tags sent with it.
• To keep the site working, secure and free of spam.
• To comply with the law.

We do not use your information for automated decision-making or profiling that produces legal or similarly significant effects.

BRI Health Inc. is a Delaware corporation. Submissions are stored in the United States by our form processor and reach our inbox, and our team may read them from outside the United States, including from Israel. Where information moves between countries, we rely on our providers' contractual safeguards, such as the European Commission's Standard Contractual Clauses where they apply.

We use reasonable technical and organizational measures to protect the information you send: the site is served only over HTTPS, the form posts directly to our processor over an encrypted connection, and only our team can read submissions. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

This site is intended for healthcare practices and the professionals who run them. It is not directed to children, and we do not knowingly collect information from anyone under 16. If you believe a child has sent us information, email us and we will delete it.

Residents of some US states, including California, have rights over their personal information. In the last 12 months, the only categories we have collected through this site are identifiers (name, email address, IP address in server logs), professional information (clinic name, role, EHR and practice figures you choose to send) and, if you arrive from an ad, campaign tags. We collect them from you directly and use them for the purposes above. We do not sell or share personal information as those laws define it, so there is nothing to opt out of; the site also has no tracking to switch off for a Global Privacy Control or Do Not Track signal. You may ask to know, access, correct or delete your information, and we will not treat you differently for asking. You may use an authorized agent; we may need to verify your identity, and your agent's authority, before acting on a request.

Where the EU/UK GDPR applies, our basis for handling pilot-request submissions is taking steps at your request before any potential engagement. Where you tick the optional updates box, the basis for those updates is your consent, which you can withdraw at any time by using the unsubscribe link in any such email or by emailing us. You are never required to fill in the form to use the site. Our basis for technical server logs and, if you send one with your request, an ad-campaign tag, is our legitimate interest in keeping the site secure and understanding which of our own ads work.

We keep pilot-request submissions, including any estimator figures sent with them, for up to 24 months from our last contact with you, after which they are deleted. Our form processor keeps its own copy for up to three years and then deletes it automatically. Server access logs are kept by our host under its standard retention. You can ask us to delete your details sooner at any time, and we will. Ad-campaign tags and your clinic-mode preference stay in your browser unless you send a pilot request. If you do, they are part of that submission and are kept as described above.

Depending on where you live, you may have the right to access, correct, or delete the personal information we hold about you, to object to or restrict its processing, to receive a copy in a portable format, and to withdraw consent where we rely on it. To exercise any of these, email info@brihealth.ai; we will respond within 30 days, or sooner where the law requires. If our response does not satisfy you, you can complain to the data-protection authority where you live, for example a US state attorney general, an EU or UK supervisory authority, or the Israeli Privacy Protection Authority, where their rules apply to you. We may ask you to confirm your identity, for example by replying from the email address you used, before we complete a request.

Questions about this policy, or requests regarding your information, go to BRI at info@brihealth.ai.

We may update this policy as the site or our practices change. The "last updated" date above always reflects the current version. If a change is material, we will say so clearly on this page before it takes effect.