Privacy Policy

Draft for attorney review. This version is not yet in effect.

In short: your practice is in charge of your health information, and we handle it only on the practice's behalf. We collect what is needed to run the platform, we never sell it or use it for advertising, and each care-team member sees only what their job requires.

What this policy covers

This policy explains how Bare Health Technologies, Inc. ("Bare Health," "we," "us") handles personal information when you:

visit barehealthtechnologies.com or send us a form, such as "Reserve Your Spot" or "Apply to Join";
use the Bare Health platform as a patient, a patient's representative, a practice team member, or a provider, pharmacy or laboratory professional.

Our role with health information

Your practice, not Bare Health, is responsible for your health information under HIPAA and state law. Bare Health is the practice's business associate. We handle health information only as our written agreement with the practice allows, and as the law requires.

Your practice's Notice of Privacy Practices explains how your health information is used and shared and how to exercise your rights. If this policy and that notice ever differ about your health information, the practice's notice and our agreement with the practice control.

We do not sell personal information. We do not use health information for advertising.

Information we collect

From website visitors and inquiries

What you enter in our forms: name, work email, organization, your role, the states you serve, and any notes you add.
Please do not send patient information or license numbers through website forms.

Account details

Name, email, phone, a hashed password, and an optional passkey or Google sign-in.

Care information

Intake answers, signed consents, messages, appointments, orders, prescriptions, uploaded files such as lab results, and visit records.
Health details you or your care team add to your chart, such as allergies, medications, conditions and measurements.
The state you are located in at the time of care, which you report so that a properly licensed provider can treat you.
Whether a message was delivered and read.

Identity verification

When your practice requires it, a photo of a government-issued ID and a photo of your face. Authorized care-team members compare them to confirm who you are.
We store these images in private storage. We do not use them to create face templates or for facial recognition.

Professional credentials

For providers, pharmacies and laboratories: license numbers and states, National Provider Identifier, prescribing authority, the last four characters of a DEA registration, liability insurance details, and verification results.

Payments

Card details go directly to the payment processor. Bare Health keeps only the amount, order number, date, the last four digits and the card brand.
For practices and partners: payout and bank-connection status from the payment processor.

Technical and security records

Sign-in times, security events, device and browser information, and a record of who viewed or changed sensitive records. We keep these for account security and HIPAA audit requirements.

Cookies

We use only the cookies and local storage needed to sign you in and keep your session secure. We do not use advertising cookies. If we add website analytics, we will update this policy first.

How we use information

To run the platform: accounts, forms, scheduling, messaging, video visits, orders, prescriptions, payments and receipts.
To connect care teams: each role sees only what its job requires. For example, shipping staff see a delivery address but not a chart.
To send notices: sign-in codes, invitations, reminders and alerts. These never include care details.
To respond to inquiries: if you send a website form, we use it to contact you about joining Bare Health.
To keep things safe and lawful: security, fraud prevention, troubleshooting, audits and legal compliance.

Text messages

If you choose to receive text messages, we send reminders and alerts that contain no care details. Message frequency varies. Message and data rates may apply. Reply STOP to stop or HELP for help, or change your preferences in the portal.

We do not share mobile phone numbers or text-message consent with third parties or affiliates for their marketing.

Google sign-in

If you sign in with Google, Bare Health receives only your name, email address and profile picture. We do not request access to Gmail, contacts, calendar or files, and we do not share Google user data. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

With your practice and its care partners. Providers, pharmacies and laboratories connected to your practice receive the minimum information needed for their part of your care.
With service providers. Vendors that host our database, send email and text messages, run video visits and process payments. They may use the information only to provide their service to us, under business associate agreements where required. The payment processor receives the amount, order number, practice name and email, and never treatment or health details.
With Bare Health support, with permission. Our team can open patient records only when the practice approves a request for a set time, or in a documented emergency. Every access is logged.
When the law requires it, or to protect the safety of patients, the public or the platform.
In a business change. If Bare Health is reorganized or acquired, information may transfer to the successor, which must honor this policy and our agreements with practices.

Security

We use encryption in transit and at rest, role-based access enforced in the database, detailed audit logs, required two-step sign-in for team accounts and automatic sign-out. No system is perfectly secure. If a breach affects your information, we will notify the practice and affected people as the law requires.

To report a security concern, email it@barehealthtechnologies.com.

How long we keep information

Health records: for as long as medical-record laws and our agreement with the practice require, then deleted or de-identified.
Identity images: for as long as the practice needs them to document verification, then deleted.
Account and audit records: for as long as security and legal requirements call for. HIPAA documentation is kept at least six years.
Website inquiries: until you join, ask us to delete them, or two years pass without contact.

Your choices and rights

Update your contact details and notification settings in the portal, and turn off email or text reminders.
To see, copy or correct your health records, contact your practice. We help practices respond to these requests.
Manage what a representative can do on your behalf, or remove them.
Depending on where you live, you may have rights to access, correct or delete personal information that is not part of a health record, and to appeal our decision. Email support@barehealthtechnologies.com. We do not discriminate against anyone for making a request.

Children

Accounts are for adults. A parent or guardian may arrange a minor's care through a practice. The website is not directed to children under 13, and we do not knowingly collect their information there.

United States only

Bare Health is offered in the United States, and information is stored in the United States.

Changes to this policy

We will post updates here with a new date. For significant changes, we will also tell you in the platform or by email before they take effect.

Contact us

Privacy questions: support@barehealthtechnologies.com
Security reports: it@barehealthtechnologies.com
Bare Health Technologies, Inc. (in formation), Apple Valley, Minnesota, United States

For questions about your care, contact your practice. In a medical emergency, call 911.