
Privacy Policy & AI Disclosures
How HealixAI protects your electronic health records (EHR), clinical data, and AI interactions through HIPAA-compliant encryption, stateless voice streams, and strict data sovereignty.
1. Clinical Data & SMART-on-FHIR Scopes
HealixAI utilizes the industry standard SMART on FHIR (Fast Healthcare Interoperability Resources) framework and official Medicare API channels to connect to electronic health records. We explicitly request read-only access to the following clinical scopes:
Strict Read-Only Guarantee:
HealixAI never requests write access to your primary medical record. We cannot alter, delete, or create records in your physician's hospital portal. All EHR synchronizations are strictly read-only.
2. AI Architecture & Zero Model Training Guarantee
HealixAI utilizes clinical machine learning and voice models under a signed Google Cloud Business Associate Agreement (BAA):
Absolute Zero Model Training Guarantee
Your personal health data, Medicare records, voice audio, and conversational transcripts are NEVER used to train public AI models, foundation LLMs, or third-party algorithms. All processing occurs statelessly in memory under signed BAAs.
3. Voice Streaming & Telephony Privacy
“All audio streaming happens statelessly over TLS 1.3 encrypted connections under our signed Google Cloud BAA. Our platform does not store raw voice recordings or audio transcripts on translation nodes, which keeps us fully compliant with HIPAA security rules.”
Both inbound SIP telephony calls and in-app WebRTC sessions terminate directly into ephemeral voice sessions. Call streams are destroyed immediately upon call termination.
4. Responsible AI Disclosure & Safety Reporting
While our clinical engine is grounded in validated medical literature (PubMed, AMA, CDC, CMS), AI systems may occasionally return unexpected outputs.
AI Safety & Error Reporting Channel:
If you observe any abnormal or unexpected AI behavior, contact our Clinical Safety Team immediately at ai-safety@healixai.com. Reports are reviewed by licensed physicians within 24 hours.
5. Data Retention, Dormant Accounts & Right to Revoke
You maintain complete sovereignty over your health records. You may disconnect HealixAI access to your patient portal, Medicare.gov, or VA Lighthouse at any time.
If an account remains dormant (defined as no user login, conversational voice interaction, or active FHIR synchronization) for twelve (12) consecutive months (365 calendar days), HealixAI will automatically, permanently, and cryptographically purge all synchronized Veteran health records and all non-VA shared medical data from all active databases and ephemeral cache stores. An advance notice warning will be dispatched to the user's registered email at eleven (11) months (30 days prior to purge).
Upon account closure, all cached tokens and synchronized health data are cryptographically purged within 30 calendar days. To request immediate on-demand deletion of all records, email privacy@healixai.com or click “Disconnect Vault” in settings. We execute and confirm data purging within 5 business days.
6. HIPAA Security & Encryption Standards
7. Department of Veterans Affairs (VA) Lighthouse API & Veteran Data Covenant
HealixAI provides dedicated interoperability with the Department of Veterans Affairs (VA) through the VA Lighthouse Developer Platform. To protect those who served our nation, we enforce the following strict statutory data protection covenants across all Veteran records:
7.1 Strict Prohibition on the Sale of Veteran Data
HealixAI explicitly confirms and warrants that no Veteran data is sold, rented, leased, licensed, or monetized for profit or other monetary transactions under any circumstances. Veteran medical records, disability ratings, and health histories are used strictly and solely to deliver personal clinical summaries, voice consultations, and care management directly to the Veteran. We never share, broker, or monetize Veteran data with commercial advertisers, data aggregators, or unauthorized third parties.
7.2 Security Breach Notification Protocol & Veteran Protective Actions
If there is a confirmed or suspected breach or unauthorized disclosure of a Veteran's data, HealixAI will notify the affected Veteran directly without unreasonable delay and in no case later than forty-eight (48) hours following breach confirmation (or within statutory HIPAA/federal requirements, whichever is shorter). Notification will be delivered via primary registered email and an urgent in-app alert.
- Revoke VA Application Access: Clear steps on how to instantly disconnect HealixAI access to your records through your official VA.gov profile settings or by contacting the VA Health Resource Center.
- Credential Reset: Immediate guidance on resetting your HealixAI password and checking associated email security.
- Identity Protection: Complimentary identity theft protection and credit monitoring enrollment information whenever sensitive identity markers are impacted.
- Direct Safety Liaison: Direct 24/7 contact instructions to reach the HealixAI Data Protection Officer (privacy@healixai.com) and the VA Information Security Officer.
7.3 Transfer of Ownership, Sale of Business, or Corporate Dissolution
In the event that HealixAI undergoes a change of ownership, corporate merger, acquisition, sale of company assets, or ends/sells its business:
- Veterans will be provided at least thirty (30) calendar days advance written notice prior to any transfer of control taking effect.
- Veterans will be provided the absolute right to opt out and request the immediate, complete cryptographic purging of all their health records before any transfer occurs.
- No Veteran data will be transferred unless the acquiring or successor entity legally agrees to be bound by the exact same (or more protective) non-sale, privacy, and security commitments set forth in this policy.
- In the event the company ceases operations or dissolves without a qualifying successor, all Veteran data and tokens will be permanently and cryptographically purged in compliance with NIST SP 800-88 guidelines, and will never be sold, auctioned, or liquidated as business assets.
7.4 Notice of Changes to Privacy Policy and Terms of Service
HealixAI will notify users, including Veterans, of any material changes made to this Privacy Policy and the Terms of Service. Notice will be provided at least thirty (30) calendar days in advance of the changes becoming effective via:
- Direct electronic mail sent to the Veteran's registered email address; and
- A prominent, persistent alert notification banner displayed inside the HealixAI web and mobile applications upon login.
- The official “Last Updated” timestamp displayed at the top of these documents will always reflect the most recent revision date.
7.5 Data Retention Policy & Dormant Account Purging (VA and Non-VA Data)
HealixAI strictly enforces the following data retention timeline for all accounts containing Veteran data and any non-VA health records shared by the user:
- Active Retention: While an account remains active, clinical data is stored in encrypted format to enable longitudinal health monitoring and real-time clinical voice assistance.
- 12-Month Dormancy Expiration: If an account remains dormant (defined as no user login, conversational interaction, or authenticated FHIR sync) for a consecutive period of twelve (12) months (365 calendar days), HealixAI automatically, permanently, and cryptographically purges all Veteran health records, synchronized observations, and all non-VA shared health data from active storage and ephemeral caches.
- 30-Day Pre-Purge Warning: At eleven (11) months of dormancy (335 days), an automated reminder will be sent to the Veteran's registered email advising them of pending account purge unless they log in.
- Immediate On-Demand Purge: At any time, a Veteran may request immediate deletion of their data by emailing privacy@healixai.com or selecting “Disconnect Vault” in settings. Deletion is executed and confirmed within 5 business days.
7.6 Prohibition on Third-Party Use/Disclosure & Mandatory Vendor Binding
HealixAI clearly states and explicitly covenants that third-party use or disclosure of user information (including de-identified, anonymized, or pseudonymized data) is strictly prohibited for any reason without prior affirmative consent from the user. Furthermore, HealixAI contractually and legally requires that all third-party vendors, cloud infrastructure providers, business associates, and contractors are bound to the exact same commitments to users regarding the use, disclosure, and protection of user data.
8. Privacy Officer & Governance Directory
Healix AI, Inc. / HealixAI, LLC
Clinical Leadership & AI Safety Officer: Ricardo Hamilton, MD
Privacy Inquiries & Deletion Requests: privacy@healixai.com
AI Safety Reporting: ai-safety@healixai.com
General Support: support@healixai.com