Privacy Policy

1. Overview & HIPAA Scope

ClinicVerify Inc. ("ClinicVerify," "we," "us," or "our") provides an automated insurance intake and real-time EDI 270/271 eligibility verification SaaS platform for medical practices, healthcare providers, and billing organizations ("Covered Entities" or "Customers").

When ClinicVerify processes Protected Health Information ("PHI") on behalf of Covered Entities, we act strictly as a Business Associate under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and their implementing regulations at 45 C.F.R. Parts 160 and 164.

2. Information We Process

• Protected Health Information (PHI): Patient full name, date of birth, contact email/phone, health insurance card images (front and back), member ID, subscriber ID, payer ID, group number, and clearinghouse eligibility responses (copays, deductibles, coinsurance, and pre-authorization requirements).
• Clinic Account Data: Practice name, National Provider Identifier (NPI), Tax ID (TIN), authorized staff user email addresses, login credentials, billing contact details, and payment transaction references.
• Technical & Audit Logs: IP address, user agent, login timestamps, file upload records, API request IDs, and clearinghouse EDI 270/271 transaction receipt codes.

3. How We Use Information

We use the information collected exclusively for the following authorized healthcare purposes:

• Executing OCR text extraction on uploaded insurance card photos.
• Formatting and dispatching real-time EDI 270 eligibility inquiry transactions to healthcare clearinghouse networks and insurance payers.
• Delivering parsed EDI 271 eligibility benefit summaries, copay details, and pre-authorization flags to authorized clinic staff dashboards.
• Maintaining immutable audit trail receipts required for HIPAA compliance and claims defense.
• Providing customer support and processing subscription billing.

🔒 Strict Promise: ClinicVerify does NOT sell, rent, monetize, or disclose patient PHI or clinic data to third-party advertisers or data brokers under any circumstances.

4. Technical Safeguards & Encryption

ClinicVerify enforces industry-leading technical, physical, and administrative safeguards in full alignment with the HIPAA Security Rule:

• Data Encryption: All PHI and credentials are encrypted at rest using AES-256 bit encryption and in transit over public networks using TLS 1.3 encryption protocols.
• Automated Card Image Purging: Insurance card image files are automatically purged from storage servers according to the clinic's configured data retention policy (0, 7, 30, or 90 days after OCR parsing).
• Access Control & RBAC: Multi-tenant isolation with strict Role-Based Access Control (RBAC) ensuring clinic staff access is restricted strictly to authorized practice records.
• Infrastructure Security: Server infrastructure hosted in SOC 2 Type II and ISO 27001 certified data center facilities with automated automated backup and intrusion monitoring.

5. Subprocessors & Clearinghouses

To deliver real-time eligibility services, ClinicVerify engages vetted subprocessors operating under executed HIPAA Business Associate Agreements:

• Insurance Clearinghouses: For routing X12 EDI 270/271 eligibility verification requests to over 900 payer networks.
• Cloud Infrastructure (AWS / Supabase): For secure database hosting, encrypted storage, and serverless compute.
• Twilio / Email Services: For dispatching patient intake SMS and email links on behalf of clinics.
• Stripe: For processing clinic SaaS subscription payments (credit card information is handled directly by Stripe and never stored on ClinicVerify servers).

6. Patient Rights & Access Requests

Under HIPAA, individual patients have the right to inspect, copy, or amend their health information. Because ClinicVerify processes data solely on behalf of Covered Entities, patients seeking access to or correction of their records should submit their request directly to their healthcare provider practice. ClinicVerify assists practices in fulfilling authorized patient access requests as required under our BAA.

7. Contact & Privacy Officer

If you have questions regarding this Privacy Policy, HIPAA safeguards, or data processing procedures, please contact our Privacy Officer via our Support Contact Page, review our Business Associate Agreement (BAA), or consult our Terms of Service: