Clinic in a Box — Privacy Policy

Effective date: June 23, 2026 · Last updated: June 23, 2026

Clinic in a Box ("the App") is a HIPAA-aware, mobile practice-management application operated by Global Audiology Consulting LLC ("we," "us," "our"). The App is provided to independent clinics and their authorized staff (clinicians and administrators) to manage scheduling, patient records, secure messaging, insurance claims, billing, provider credentialing, and—at the clinic's option—read-only access to the clinic's Electronic Health Record (EHR) via the SMART on FHIR standard.

Clinic in a Box is not a medical device. It does not diagnose, treat, cure, or prevent any disease or condition.

Who controls the health data. The App is a tool used by healthcare providers. For protected health information (PHI) that a clinic processes through the App, the clinic is the "covered entity" (or its business associate) and we act as the clinic's Business Associate under the U.S. Health Insurance Portability and Accountability Act (HIPAA). We process PHI only as permitted by our Business Associate Agreement (BAA) with the clinic. If you are a patient, please direct privacy requests about your health records to your healthcare provider.

1. Information we collect

Account & clinic information

Clinician/administrator name, email, role, and authentication credentials.
Practice/clinic details and provider credentialing data (e.g., NPI, license and DEA expirations) the clinic enters.

Protected health information (PHI)

Patient demographics, appointments, clinical notes, lab results, conditions, medications, insurance claims, and invoices that authorized staff enter or that are synced from a connected EHR.
EHR data is accessed read-only through SMART on FHIR, only after an authorized clinician signs in to their EHR and authorizes the connection, and is limited to the scopes the clinic approves.

Payment information

Subscription and patient-invoice payments are processed by Stripe. We do not collect or store full card numbers; Stripe handles card data under PCI-DSS.

Device & usage information

Limited technical and diagnostic data (device type, OS version, crash logs, in-app actions) to operate, secure, and improve the App. We do not use this data to track you across other companies' apps or websites, and we do not sell personal information.

2. How we use information

To provide and operate the App's features for the clinic.
To synchronize and display EHR data the clinic has authorized via SMART on FHIR.
To process insurance claims (X12 EDI 837P), patient invoices, and subscriptions.
To send appointment and credential reminders and secure messages on the clinic's behalf.
To maintain security, audit access to PHI, prevent fraud, and meet legal obligations.

We process PHI solely to perform services for the clinic and as permitted by the BAA and HIPAA; we do not use PHI for advertising and never sell it.

3. How we share information

We share information only as needed to run the service, with service providers ("subprocessors") that are contractually bound to protect it, including:

Provider	Purpose
Google Firebase / Google Cloud	Authentication, database, file storage, and serverless functions (data hosted in the United States)
Stripe	Payment processing (patient invoices and the practice subscription)
Stedi	Electronic insurance claim submission and remittance (X12 837P / 835) clearinghouse, when the clinic files claims
Twilio	SMS notifications (when enabled by the clinic)
SendGrid	Email notifications (when enabled by the clinic)
EHR vendors (e.g., Epic)	Read-only FHIR access the clinic authorizes via SMART on FHIR

We may also disclose information to comply with law, enforce our agreements, or protect the rights, safety, and security of users and the public. We do not sell personal information or PHI.

4. How we protect information

Encryption of data in transit (TLS) and at rest.
Role-based access controls and least-privilege access to PHI.
Audit logging of PHI access within the App.
Optional device-level biometric lock (Face ID / fingerprint) and inactivity locking.
EHR access tokens are stored securely on the device and limited to read-only scopes.

5. Data retention & deletion

We retain clinic and PHI data for as long as the clinic maintains its account or as required by the BAA and applicable law, after which it is deleted or de-identified. Clinics may request export or deletion of their data as provided in their agreement. Patients should contact their provider to exercise rights over their health records.

6. Your choices & rights

Authorized users may access and update account information in the App. Depending on your jurisdiction, you may have rights to access, correct, or delete personal information; requests are handled through the clinic where PHI is involved. Contact us using the details below.

7. Children's privacy

The App is intended for use by healthcare professionals and is not directed to children. Any pediatric PHI is processed on behalf of the clinic under the BAA, not collected from children directly by us.

8. Changes to this policy

We may update this policy from time to time. Material changes will be posted here with a revised effective date.

9. Contact us

Global Audiology Consulting LLC
625 S Twin Oaks Valley Rd. #79, San Marcos, CA 92078
Email: drledee@globalaudiologyconsulting.com