HealixAI Logo
HIPAA, CMS HTI-1 & VA Lighthouse Compliant • Zero PHI Retention

Privacy Policy & AI Disclosures

How HealixAI protects your electronic health records (EHR), clinical data, and AI interactions through HIPAA-compliant encryption, stateless voice streams, and strict data sovereignty.

Effective Date: April 1, 2026Last Updated: October 2026 (VA Lighthouse Certified & CARIN Code of Conduct)

1. Clinical Data & SMART-on-FHIR Scopes

HealixAI utilizes the industry standard SMART on FHIR (Fast Healthcare Interoperability Resources) framework and official Medicare API channels to connect to electronic health records. We explicitly request read-only access to the following clinical scopes:

Patient Profile & Demographics (Patient.read)
Medications & Prescriptions (MedicationRequest.read)
Clinical Conditions (Condition.read)
Laboratory & Vitals (Observation.read)
Medicare Claims Data (ExplanationOfBenefit.read)
Immunization History (Immunization.read)
Allergies & Intolerances (AllergyIntolerance.read)
Surgical Procedures (Procedure.read)
Diagnostic Imaging Reports (DiagnosticReport.read)
Insurance Benefits (Coverage.read)
VA Veteran Health API (patient/*.read)
VA Community Care & Status (community_care.read, veteran_status.read)

Strict Read-Only Guarantee:

HealixAI never requests write access to your primary medical record. We cannot alter, delete, or create records in your physician's hospital portal. All EHR synchronizations are strictly read-only.

2. AI Architecture & Zero Model Training Guarantee

HealixAI utilizes clinical machine learning and voice models under a signed Google Cloud Business Associate Agreement (BAA):

Google Gemini Live S2SReal-time speech-to-speech voice companion operating over encrypted WebRTC audio pipes.
BigQuery Vector SearchIndexes 2.3M+ peer-reviewed PubMed articles for sub-150ms clinical citation grounding.
Clinical ML EngineNormalizes LOINC lab values and RxNorm medication categories for drug-drug interaction safety.

Absolute Zero Model Training Guarantee

Your personal health data, Medicare records, voice audio, and conversational transcripts are NEVER used to train public AI models, foundation LLMs, or third-party algorithms. All processing occurs statelessly in memory under signed BAAs.

3. Voice Streaming & Telephony Privacy

“All audio streaming happens statelessly over TLS 1.3 encrypted connections under our signed Google Cloud BAA. Our platform does not store raw voice recordings or audio transcripts on translation nodes, which keeps us fully compliant with HIPAA security rules.”

Both inbound SIP telephony calls and in-app WebRTC sessions terminate directly into ephemeral voice sessions. Call streams are destroyed immediately upon call termination.

4. Responsible AI Disclosure & Safety Reporting

While our clinical engine is grounded in validated medical literature (PubMed, AMA, CDC, CMS), AI systems may occasionally return unexpected outputs.

AI Safety & Error Reporting Channel:

If you observe any abnormal or unexpected AI behavior, contact our Clinical Safety Team immediately at ai-safety@healixai.com. Reports are reviewed by licensed physicians within 24 hours.

5. Data Retention, Dormant Accounts & Right to Revoke

You maintain complete sovereignty over your health records. You may disconnect HealixAI access to your patient portal, Medicare.gov, or VA Lighthouse at any time.

Account Dormancy Policy (VA & Non-VA Data Shared)

If an account remains dormant (defined as no user login, conversational voice interaction, or active FHIR synchronization) for twelve (12) consecutive months (365 calendar days), HealixAI will automatically, permanently, and cryptographically purge all synchronized Veteran health records and all non-VA shared medical data from all active databases and ephemeral cache stores. An advance notice warning will be dispatched to the user's registered email at eleven (11) months (30 days prior to purge).

On-Demand Deletion & Account Closure

Upon account closure, all cached tokens and synchronized health data are cryptographically purged within 30 calendar days. To request immediate on-demand deletion of all records, email privacy@healixai.com or click “Disconnect Vault” in settings. We execute and confirm data purging within 5 business days.

6. HIPAA Security & Encryption Standards

TLS 1.3 In-Transit EncryptionAll REST API calls, WebRTC media streams, and database queries use modern cryptographic ciphers.
AES-256 At-Rest EncryptionUser settings and cached metadata are encrypted at rest with managed Google Cloud KMS keys.
OAuth 2.0 / PKCE TokensShort-lived access tokens with automatic rotation prevent persistent credential exposure.
SOC 2 Type II ControlsContinuous automated security audits, vulnerability scanning, and role-based access control.

7. Department of Veterans Affairs (VA) Lighthouse API & Veteran Data Covenant

HealixAI provides dedicated interoperability with the Department of Veterans Affairs (VA) through the VA Lighthouse Developer Platform. To protect those who served our nation, we enforce the following strict statutory data protection covenants across all Veteran records:

7.1 Strict Prohibition on the Sale of Veteran Data

HealixAI explicitly confirms and warrants that no Veteran data is sold, rented, leased, licensed, or monetized for profit or other monetary transactions under any circumstances. Veteran medical records, disability ratings, and health histories are used strictly and solely to deliver personal clinical summaries, voice consultations, and care management directly to the Veteran. We never share, broker, or monetize Veteran data with commercial advertisers, data aggregators, or unauthorized third parties.

7.2 Security Breach Notification Protocol & Veteran Protective Actions

If there is a confirmed or suspected breach or unauthorized disclosure of a Veteran's data, HealixAI will notify the affected Veteran directly without unreasonable delay and in no case later than forty-eight (48) hours following breach confirmation (or within statutory HIPAA/federal requirements, whichever is shorter). Notification will be delivered via primary registered email and an urgent in-app alert.

Actionable Instructions Provided to the Veteran:
  • Revoke VA Application Access: Clear steps on how to instantly disconnect HealixAI access to your records through your official VA.gov profile settings or by contacting the VA Health Resource Center.
  • Credential Reset: Immediate guidance on resetting your HealixAI password and checking associated email security.
  • Identity Protection: Complimentary identity theft protection and credit monitoring enrollment information whenever sensitive identity markers are impacted.
  • Direct Safety Liaison: Direct 24/7 contact instructions to reach the HealixAI Data Protection Officer (privacy@healixai.com) and the VA Information Security Officer.

7.3 Transfer of Ownership, Sale of Business, or Corporate Dissolution

In the event that HealixAI undergoes a change of ownership, corporate merger, acquisition, sale of company assets, or ends/sells its business:

  • Veterans will be provided at least thirty (30) calendar days advance written notice prior to any transfer of control taking effect.
  • Veterans will be provided the absolute right to opt out and request the immediate, complete cryptographic purging of all their health records before any transfer occurs.
  • No Veteran data will be transferred unless the acquiring or successor entity legally agrees to be bound by the exact same (or more protective) non-sale, privacy, and security commitments set forth in this policy.
  • In the event the company ceases operations or dissolves without a qualifying successor, all Veteran data and tokens will be permanently and cryptographically purged in compliance with NIST SP 800-88 guidelines, and will never be sold, auctioned, or liquidated as business assets.

7.4 Notice of Changes to Privacy Policy and Terms of Service

HealixAI will notify users, including Veterans, of any material changes made to this Privacy Policy and the Terms of Service. Notice will be provided at least thirty (30) calendar days in advance of the changes becoming effective via:

  • Direct electronic mail sent to the Veteran's registered email address; and
  • A prominent, persistent alert notification banner displayed inside the HealixAI web and mobile applications upon login.
  • The official “Last Updated” timestamp displayed at the top of these documents will always reflect the most recent revision date.

7.5 Data Retention Policy & Dormant Account Purging (VA and Non-VA Data)

HealixAI strictly enforces the following data retention timeline for all accounts containing Veteran data and any non-VA health records shared by the user:

  • Active Retention: While an account remains active, clinical data is stored in encrypted format to enable longitudinal health monitoring and real-time clinical voice assistance.
  • 12-Month Dormancy Expiration: If an account remains dormant (defined as no user login, conversational interaction, or authenticated FHIR sync) for a consecutive period of twelve (12) months (365 calendar days), HealixAI automatically, permanently, and cryptographically purges all Veteran health records, synchronized observations, and all non-VA shared health data from active storage and ephemeral caches.
  • 30-Day Pre-Purge Warning: At eleven (11) months of dormancy (335 days), an automated reminder will be sent to the Veteran's registered email advising them of pending account purge unless they log in.
  • Immediate On-Demand Purge: At any time, a Veteran may request immediate deletion of their data by emailing privacy@healixai.com or selecting “Disconnect Vault” in settings. Deletion is executed and confirmed within 5 business days.

7.6 Prohibition on Third-Party Use/Disclosure & Mandatory Vendor Binding

HealixAI clearly states and explicitly covenants that third-party use or disclosure of user information (including de-identified, anonymized, or pseudonymized data) is strictly prohibited for any reason without prior affirmative consent from the user. Furthermore, HealixAI contractually and legally requires that all third-party vendors, cloud infrastructure providers, business associates, and contractors are bound to the exact same commitments to users regarding the use, disclosure, and protection of user data.

8. Privacy Officer & Governance Directory

Healix AI, Inc. / HealixAI, LLC

Clinical Leadership & AI Safety Officer: Ricardo Hamilton, MD

Privacy Inquiries & Deletion Requests: privacy@healixai.com

AI Safety Reporting: ai-safety@healixai.com

General Support: support@healixai.com