Privacy Policy
🔒 Privacy & HIPAA Compliance
We are committed to protecting your health information to the highest standard. Please read this policy to understand how we collect, use, share, and safeguard your data.
Introduction
Compass Vitals LLC ("Compass Vitals," "we," "our," "us") respects your privacy and is committed to protecting your personal and health information. This Privacy Policy describes how we collect, use, share, and protect information when you use the Compass Vitals website, the Compass 24/7 mobile app and web app, and related services (the "Services").
This policy applies to all patients, registered users, and visitors. When you register for Compass 24/7, you also sign a consent document that includes a HIPAA authorization and telehealth consent; that document is part of how we handle your health information. If this Privacy Policy and the consent document differ regarding your health information, the consent document governs; this Privacy Policy governs all other matters.
By using the Services, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Services.
Information We Collect
Account information
Full name, date of birth, sex, email address, phone number, home address, and US state of residence. Passwords are stored only in hashed form, never in plain text.
Health information (PHI)
Reason for visit, symptoms, medical history, surgeries, family history, current medications, allergies, height and weight, files you upload (for example lab results or prescriptions), and everything recorded during your consultation: the transcript of your conversation with the AI assistant, your physician's clinical notes, the after-visit summary, prescriptions, lab or imaging orders and results. All PHI is protected under HIPAA.
Voice consultations
You can talk with the AI assistant by voice during a consultation. On the website, audio streams directly from your browser to OpenAI. In the mobile app, audio travels from the app through our servers to our AI service and then to OpenAI. We do not record or store your voice: audio is processed in real time, and only the text of the conversation is saved in your consultation record.
Electronic signature and consent records
The name you type as your electronic signature and the time you accepted the authorization.
Pharmacy and payment information
The pharmacy you choose to receive prescriptions. Card details are collected and held by our payment processor; we do not store full card numbers. We keep transaction history and amounts.
Family features (if you use them)
Contact details of people you invite and the record-sharing permissions between family members.
Usage and technical data
Device token for push notifications, language preference, and access and security logs used to operate and audit the Services. We use internal measurement only (a random identifier stored in your browser and campaign parameters in links); we do not use third-party analytics or advertising tools. When you open the sign-in or payment screen, the website loads scripts from Google or from the payment processor, which process data under their own policies.
How We Use Your Information
- Care delivery: recording your symptoms with the AI assistant, physician review of your case, prescribing, and ordering tests.
- Care coordination: sending prescriptions to the pharmacy you choose and lab orders to the laboratory when your physician orders them.
- Billing: charging your membership fee.
- Communication and notifications: verification codes, account and consultation emails, and app notifications. Text messages and push notifications never contain medical information; they only prompt you to open the app. Health information is sent only inside the app or by encrypted email.
- Security and audit: protecting accounts, preventing fraud, and keeping audit logs of access to your information.
- Service improvement: analyzing de-identified data to improve quality and safety. We do not use your information, including de-identified information, to train AI models, and our AI providers may not use it to train their models.
- Legal compliance: meeting legal requirements, HIPAA regulations, and mandatory reporting obligations under U.S. law.
Information Sharing
We do not sell, rent, or disclose your personal or health information to third parties for commercial or advertising purposes. We share information only as follows:
Your care team. Licensed physicians and clinical staff who provide care through Compass 24/7 access your records to provide treatment. Each case is first reviewed by a physician located in Vietnam and then approved by a US-licensed physician, as described in the consent you sign at registration.
Service providers (data processors). We use the providers below to operate the Services, under HIPAA Business Associate Agreements where required.
| Provider | Purpose | Data shared |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, database, storage of uploaded files (encrypted with AWS KMS), email delivery | All account and record data; for email: address and message content |
| Twilio | Verification codes at registration, password reset, and family invitations; notification text messages | Phone number; messages contain no medical content |
| Google Firebase Cloud Messaging | Push notifications | Device token; notifications contain no medical content |
| Google Sign-In | Optional sign-in with Google | Name and email from Google |
| Stripe | Card payment processing | Card details (held by Stripe); amounts |
| DoseSpot | Electronic prescribing to your pharmacy; medication history and prescription-benefit lookups | Name, date of birth, sex, email, phone, address, height, weight, allergies, current medications, prescriptions, pharmacy |
| Junction | Lab orders and results | Name, date of birth, sex, email, phone, address, ordered tests, diagnosis codes, lab results |
| AI Health (our internal AI service) | AI symptom intake and drafting proposals for physicians; relays voice in the mobile app | Health information you provide and conversation content |
| OpenAI | AI assistant, translation of visit notes, voice consultations on the website and in the mobile app | Conversation content and health information you provide; audio from voice consultations |
Legal requirements. We may disclose information when required by court order, subpoena, or other valid legal process, or to prevent a serious threat to public health or safety.
🛡️ Our promise: your information will never be sold or shared with third parties for advertising or commercial purposes in any form.
HIPAA Compliance
Compass Vitals and the licensed physicians who provide care through Compass 24/7 protect your Protected Health Information (PHI) as required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the HITECH Act.
As a patient, you have important HIPAA rights regarding your health information:
- Right of access: request to view and receive a copy of your health records within 30 days. You can also view your consultation history and after-visit summaries in the app at any time.
- Right to amend: request correction of inaccurate or incomplete health information.
- Right to an accounting of disclosures: receive a list of instances where your information was disclosed over the past 6 years.
- Right to revoke your authorization at any time, and to receive a copy of the authorization you signed.
To exercise these rights, email privacy@compassvitals.com (see section 09). We respond within 30 days. If we need more time, we may extend this once by up to 30 days and will tell you the reason and the date to expect a response.
Data Security
We use technical and organizational measures to protect your information from unauthorized access, disclosure, alteration, or destruction:
- Encryption: data is encrypted in transit using TLS 1.2 or higher. The database, server storage, and uploaded files are encrypted at rest with AWS KMS.
- Account protection: passwords are stored only in hashed form; phone verification at registration and password reset; sessions can be signed out on all devices.
- Access controls: role-based access, so each team member sees only the information needed for their role. Access to records is written to an audit log.
Your Rights and Choices
In addition to your HIPAA rights:
- Account deletion: you can delete your account inside the Compass 24/7 app under Settings → Delete account. If a consultation is waiting for physician review, you can delete your account once that consultation is complete. Otherwise your account is closed immediately: you can no longer sign in, all your devices are signed out, your saved payment cards are removed, automatic renewal of your membership stops, and pending family invitations are cancelled. We send a confirmation to your verified email address. As required by law, we keep your medical records, prescriptions, consent records, payment history, and the identifying and contact information linked to those records for at least 7 years, or longer where state law requires. This information is used only to meet those legal obligations, not to market to you.
- Correction: update your profile information in the app at any time, or ask us to correct it.
- Marketing opt-out: opt out of marketing emails at any time using the unsubscribe link or by contacting us.
- California residents: for personal information not covered by HIPAA, you may have rights under the California Consumer Privacy Act, as amended by the CPRA, to know, correct, and delete personal information we hold and to limit the use of sensitive personal information. We do not sell or share personal information as those terms are defined in that law. To make a request, email privacy@compassvitals.com. We will not discriminate against you for exercising these rights.
Children. Compass 24/7 is only for adults aged 18 and older. We do not knowingly collect information from children.
We respond to requests within 30 days. If we need more time, we may extend this once by up to 30 days and will tell you the reason in advance.
Changes to this policy. We will update the "Last Updated" date and notify you by email or in the app before material changes take effect.
SMS Text Messages
If you opt in to text messages from Compass Vitals LLC (for example on our SMS consent or sign-up page), the following applies:
- What we collect: the phone number you provide and a record of your consent: the consent text you agreed to, the date and time, IP address, and device or browser information. We keep consent records for at least five (5) years.
- Opting out: reply STOP to any message and we stop sending messages to that number right away. Reply HELP for help.
- Not a condition of care: consent to receive text messages is not a condition of receiving healthcare services.
- Program details: message types, frequency, and costs are described in our SMS Terms.
🛡️ Your mobile number: mobile information collected for SMS is not sold or shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are not shared with any third party, other than the SMS provider (Twilio) that delivers our messages.
Contact Information
If you have questions about this Privacy Policy, wish to exercise your rights, or need to report a security concern, please contact our Privacy Officer:
- Email: privacy@compassvitals.com
- Address: Compass Vitals LLC, 13071 Brookhurst St #115, Garden Grove, CA 92843, USA