This Privacy Policy explains how My Practice Labs LLC ("My Practice Labs," "we," "us," or "our") collects, uses, stores, and protects information in connection with the My Practice Labs application and website (collectively, the "Service").
My Practice Labs is a software tool for independent health practitioners. It allows practitioners to record and organize client laboratory results, compare those results against customizable reference ranges, and generate reports. My Practice Labs is a data organization layer. It does not provide medical advice, diagnosis, or clinical interpretation.
This policy distinguishes between two categories of information:
For Client Information, the practitioner is the party that decides what to collect and why. We process that information on the practitioner's behalf and at the practitioner's direction. If you are an individual client of a practitioner and have questions about your information, please contact your practitioner directly. See Section 9 ("Your Choices and Rights").
When a practitioner uses the Service, we collect and store:
When a practitioner adds a client and records lab results, the practitioner may enter:
This information may constitute Protected Health Information ("PHI") under the Health Insurance Portability and Accountability Act ("HIPAA") when the practitioner is a HIPAA-covered entity. We treat all Client Information as confidential regardless of whether HIPAA applies to a given practitioner.
A practitioner may upload a laboratory report as a PDF so that values can be extracted automatically. These files are handled as described in Section 4 ("Automated Lab Report Processing") and Section 6 ("Data Retention and Deletion").
When you use the Service or visit our website, our infrastructure providers and our application may process:
We do not use third-party advertising networks, behavioral tracking, or third-party web analytics services. We do not place tracking cookies.
Our public website includes a contact and beta-interest form. If you submit it, we collect the information you provide (such as your name, email address, and message). This form is operated through a third-party form provider (see Section 5). We use submissions to respond to you and to administer the beta program.
We use the information we collect to:
We do not sell personal information or Client Information. We do not use Client Information for advertising. We do not use Client Information to train artificial intelligence models, and our automated processing provider does not use it to train its models (see Section 4).
When a practitioner uploads a lab report PDF, the file is processed by an artificial intelligence model hosted within Amazon Web Services ("AWS") Bedrock to extract laboratory marker values. The following safeguards apply:
The extracted values are presented to the practitioner for review and are saved only when the practitioner chooses to save the visit.
The Service is hosted on AWS in the United States. Client Information and Practitioner Account Information are stored in AWS managed databases and storage, encrypted at rest, and transmitted over encrypted connections. We have entered into a Business Associate Addendum with AWS covering the AWS services we use to process PHI.
We share information only with service providers that help us operate the Service, and only to the extent necessary for that purpose. Our principal service providers are:
We may disclose information if required to do so by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud or security issues.
We do not otherwise disclose Client Information to third parties.
We maintain administrative, technical, and physical safeguards designed to protect information against unauthorized access, disclosure, alteration, and destruction. These include:
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We continue to strengthen our safeguards as the Service matures.
Practitioners are responsible for the Client Information they enter into the Service, including obtaining any consents or authorizations required under the laws applicable to their practice, and for complying with all laws governing their handling of client health information. Practitioners are responsible for safeguarding their account credentials and for the activity that occurs under their account.
If you are a practitioner, you may access and update your account information within the Service, and you may delete client and visit records at any time. To close your account, contact us using the information in Section 12.
If you are a client of a practitioner, the practitioner controls your information within the Service. Requests to access, correct, or delete your information should be directed to your practitioner. If you contact us directly, we will refer your request to the relevant practitioner, as we act on their behalf and at their direction.
Depending on where you live, you may have additional rights under applicable privacy laws. We will honor those rights to the extent they apply to us and to the role we play with respect to the information in question.
The Service is intended for use by professional practitioners, not by children, and is not directed to children. A practitioner may, in the course of their practice, record information about a client who is a minor. In that case, the practitioner is responsible for obtaining any consents required by law. We do not knowingly collect information directly from children through the Service.
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date above and, where appropriate, notify practitioners through the Service or by email. Your continued use of the Service after an update constitutes acceptance of the revised policy.
For questions about this Privacy Policy or our handling of information, contact us at:
My Practice Labs LLC