Post-Op AI Privacy Policy

Post-Op AI does not provide medical, dental, veterinary, or mental health care, and we do not establish a direct treatment relationship with any patient. We act as a technology vendor and service provider to Practices.

Where a Practice is a "Covered Entity" or "Business Associate" under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA"), Post-Op AI acts as that Practice's Business Associate. In that role:

• We handle Protected Health Information ("PHI") on behalf of, and at the direction of, the Practice.
• Our handling of PHI is governed by a Business Associate Agreement ("BAA") between Post-Op AI and the Practice. Where the BAA and this Policy differ with respect to PHI, the BAA controls.
• The Practice — not Post-Op AI — is the entity that controls the patient relationship, determines the purposes for which Patient Data is used, and retains clinical and professional responsibility for patient care, including responsibility for configuring and maintaining the AI modeling and escalation ("red-flag") rules used in its account (see Section 6).

Note on veterinary practices: Animal and pet-owner information is generally not PHI under HIPAA. We nonetheless treat veterinary client and patient information as confidential and protect it under the same security and access controls described in this Policy.

When a Practice creates an account or uses the Services, we may collect:

• Account and contact information: practice name, legal business name, business address, the names, email addresses, phone numbers, and job roles of authorized users.
• Authentication data: usernames, passwords (stored in hashed form), and access logs.
• Billing and payment information: billing contact, plan tier, and payment details processed through our payment processor. We do not store full payment card numbers on our systems.
• Configuration data: the procedures, protocols, check-in schedules, message templates, branding, and avatar/video settings a Practice configures.
• Usage and technical data: log data, device and browser information, IP address, feature usage, and diagnostic information collected automatically when staff use the Services.
• Communications with us: support requests, correspondence, and feedback.

On behalf of and at the direction of a Practice, we process information about the patients, clients, and pet owners the Practice asks us to contact. Depending on the Practice's configuration, this may include:

• Identifiers and contact details: name, mobile phone number, and (where provided) email address.
• Care-related information: the procedure or visit type, appointment or procedure date, provider name, and the post-visit check-in protocol assigned by the Practice.
• Responses and interactions: the patient's replies to automated check-in messages, reported symptoms, ratings, and any free-text responses they send back.
• Message metadata: delivery status, timestamps, and opt-in/opt-out status.

Patients generally do not create accounts with Post-Op AI. Their information is provided to us by the Practice (for example, from the Practice's scheduling or practice-management system) so that we can deliver follow-up communications and relay responses back to the Practice.

If you are a patient and have questions about why you were contacted, or you want your information corrected or removed, please contact your Practice directly, as they control your record. You may also contact us using the details in Section 14, and we will work with the Practice to address your request.

Post-Op AI sends post-visit follow-up text messages on behalf of Practices using a regulated business messaging platform (currently Twilio).

• Consent. Patients receive messages because the Practice has represented to us that the patient is an existing patient/client and has a relationship that supports follow-up communications, and/or that the patient has consented to receive messages. Practices are responsible for obtaining and maintaining any legally required consent.
• Message content. Messages relate to post-operative or post-visit care, recovery check-ins, and related follow-up. They are not marketing or promotional messages.
• Message frequency. Frequency varies based on the Practice's check-in protocol and the patient's responses.
• Rates. Message and data rates may apply, depending on the patient's mobile carrier and plan.
• Opt-out. Patients can opt out at any time by replying STOP to any message. After opting out, they will receive a confirmation and no further messages, unless they later opt back in.
• Help. Patients can reply HELP for assistance or contact the Practice or Post-Op AI directly.
• Carriers. Mobile carriers are not liable for delayed or undelivered messages.

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Patient mobile phone numbers and SMS consent/opt-in information are used only to deliver the follow-up communications described above. We do not sell this information, and we do not share mobile opt-in data or consent with third parties or affiliates for their own marketing or promotional purposes. The only third parties that receive this information are the service providers (such as our messaging carrier) strictly necessary to deliver the messages.

We use Practice Data to:

• Provide, operate, maintain, and secure the Services.
• Authenticate users and manage accounts.
• Process billing and payments.
• Provide customer support and respond to inquiries.
• Monitor, troubleshoot, and improve the Services and develop new features.
• Send service-related communications (for example, security, billing, and product notices).
• Comply with legal obligations and enforce our agreements.

We use Patient Data solely to perform the Services for the relevant Practice — namely, to:

• Deliver scheduled post-visit check-in communications.
• Generate AI-assisted message content and recovery guidance configured by the Practice.
• Capture and relay patient responses back to the Practice.
• Flag responses that the Practice has configured for escalation (for example, symptoms warranting follow-up).
• Maintain delivery, consent, and audit records.

We do not use Patient Data for our own marketing, advertising, or unrelated purposes, and we do not sell Patient Data.

The Services use artificial intelligence to generate check-in messages, interpret patient responses, and produce recovery guidance and avatar-delivered video content, all according to the protocols a Practice configures.

• AI processing is performed to deliver the Services and at the Practice's direction.
• Where AI is provided through a third-party model provider, that provider acts as our subprocessor under contractual terms that restrict use of the data to providing the service to us, and (for PHI) under appropriate HIPAA safeguards. Our AI subprocessors do not use Patient Data or PHI to train their general-purpose models.
• AI-generated content supports, and does not replace, the clinical judgment of the Practice and its providers. Automated check-ins are not a substitute for professional medical advice or emergency care, and patients experiencing a medical emergency should call their local emergency number.

We share information only as described below. We do not sell personal information or PHI.

• With the Practice. Patient Data and responses are made available to the Practice on whose behalf we process them.
• With service providers (subprocessors). We use trusted vendors to operate the Services, including: cloud hosting and storage infrastructure (Amazon Web Services, in a HIPAA-eligible configuration), business messaging/SMS delivery (Twilio), AI model processing, and payment processing. These providers are bound by contract to protect the information, use it only to provide services to us, and — where PHI is involved — operate under a Business Associate Agreement.
• For legal reasons. We may disclose information if required by law, subpoena, or legal process, or to protect the rights, property, or safety of Post-Op AI, our users, or others.
• Business transfers. If Post-Op AI is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy and applicable law.
• With consent or direction. We may share information when the Practice or the individual directs or authorizes us to do so.

A current list of subprocessors is available to Practices on request.

We maintain administrative, technical, and physical safeguards designed to protect information against unauthorized access, use, alteration, and disclosure, including:

• Encryption of data in transit and at rest.
• Access controls and role-based permissions limiting who can access data.
• Hosting in a HIPAA-eligible cloud environment with audit logging.
• Authentication controls and password hashing.
• Ongoing monitoring and vendor due diligence.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Practices are responsible for safeguarding their account credentials and for managing their authorized users' access.

• We retain Practice Data for as long as the Practice maintains an account and as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements.
• We retain Patient Data for as long as needed to provide the Services to the relevant Practice and as required by the BAA and applicable law. On termination of a Practice's account, we will return or destroy PHI in accordance with the BAA, except where retention is required by law.
• We may retain de-identified or aggregated data that no longer identifies any individual.

Patients, clients, and pet owners. Because the Practice controls the patient record, requests to access, correct, or delete Patient Data should generally be directed to the Practice. If you contact us directly, we will refer or forward your request to the relevant Practice and assist as their Business Associate. Patients can stop text messages at any time by replying STOP.

Practices. Practices may access and update their account information through the Services or by contacting us. Practices remain responsible for honoring their patients' rights under HIPAA and applicable law.

Depending on where you live, you may have rights under state privacy laws (such as the California Consumer Privacy Act, as amended by the CPRA, and similar laws in other states) to request access to, correction of, or deletion of personal information, and to opt out of the "sale" or "sharing" of personal information.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

Note that information processed in the course of providing healthcare and information governed by HIPAA is generally exempt from these state laws and is handled under HIPAA instead. For non-exempt personal information, you may exercise applicable rights by contacting us at the details in Section 14. We will not discriminate against you for exercising your rights.

The Services are intended for use by Practices and their authorized staff, and are not directed to children. We do not knowingly collect personal information directly from children. Where a Practice provides Patient Data concerning a minor (for example, a pediatric dental patient), that information is processed on behalf of, and under the responsibility of, the Practice and any parent or guardian relationship the Practice maintains.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date above and, where appropriate, notify Practices through the Services or by email. Your continued use of the Services after an update constitutes acceptance of the revised Policy.

Post-Op AI

Legal entity name: Post-Op AI, LLC

Mailing address: PO Box 772, Alton, Ut 84710

Email: rob@post-op.ai

Phone: 4355907763

Website: https://www.post-op.ai

If you are a patient, client, or pet owner, you may also contact the Practice that arranged your follow-up communications for questions about your specific information.