Privacy Policy

Our role depends on whose information it is and why we hold it.

• Website visitors, prospects and customer contacts: 2care is the controller. We decide how this information is used, and this policy applies in full.
• Customer staff who use the 2care platform: 2care is the controller of account and usage information, and this policy applies.
• Patients and callers of our customers: the healthcare provider (our customer) is the covered entity or controller. 2care processes this information only on the provider’s instructions, as a HIPAA business associate in the United States, or as a processor or data intermediary elsewhere.

We collect the following information as a controller:

• Contact and business details: name, work email, phone number, job title, organization and practice details that you give us when you book a demo, fill in a form, subscribe to our newsletter or contact us.
• Account information: name, work email and role of customer staff who use the platform. Our identity provider stores login credentials in encrypted form.
• Platform usage information: the features that staff use, actions in the dashboard, device and browser type, and IP address.
• Website usage information: pages viewed, links clicked, referring site, approximate location from IP address, and device and browser data. We collect this with cookies and similar technologies (see section 11).
• Billing information: billing contact, plan and invoice history. Our payment processor collects card details. We keep only the card brand and the last four digits.
• Communications: emails, messages and notes from sales, onboarding and support conversations, and recordings of those calls where you agree.
• Demo interactions: if you call or chat with a 2care demo agent, we record and transcribe the conversation. Do not share real patient information in a demo.
• Information from other sources: business contact details from public sources, partners, events and business data providers.

When we act for a provider, the Services can process the data below. The provider decides which features to turn on. We use this data only to provide the Services to that provider, as our agreement and the BAA or DPA permit. We do not sell it, and we do not use it for our own marketing.

• Patient details, such as name, date of birth, contact details, address, preferred language and, where the provider collects it, Social Security number.
• Insurance details, such as payer, plan, member ID, group number and subscriber details, and images of insurance cards.
• Appointment, referral, medication and care-gap information from the provider’s practice systems.
• Call audio, call recordings, transcripts, AI summaries, caller phone numbers and call metadata.
• SMS, email, chat and messaging-app conversations with the provider’s patients and leads.
• Documents and forms, such as intake forms, faxes and referral documents.

• Our AI voice agents tell callers at the start of each call that they are an AI assistant, and they confirm this whenever a caller asks.
• By default, the agent tells callers that the call may be recorded for quality purposes. The provider can change this notice and is responsible for any consent that local law requires, including in states that require the consent of all parties.
• We create transcripts and summaries so that the provider’s staff can review each call and so that the Services can complete the requested task.
• The agent transfers calls to the provider’s staff as the provider instructs.

• We do not use PHI, call recordings or transcripts to train or fine-tune AI models, and our contracts with AI model providers do not allow them to do so.
• We send data to AI model providers only to deliver the Services. Where PHI is involved, we have a Business Associate Agreement with the provider.
• We use transcripts and call outcomes to test and improve the setup of each provider’s own service, such as prompts, scripts and knowledge content. A person reviews these changes before they go live.
• We keep a small set of selected calls to test and measure our agents, under the BAA. Only authorized 2care staff can access this set.
• We can create de-identified data, as HIPAA defines it (45 CFR 164.514), and aggregated statistics, and use them to measure and improve the Services. We do not try to re-identify this data, and we do not sell it.
• AI output can be wrong. Providers must review important information before they rely on it.

• To provide, operate, secure and support the website and the Services.
• To set up and manage accounts, bill customers and enforce our agreements.
• To answer questions, run demos and send service messages.
• To send newsletters and marketing emails where the law permits. You can unsubscribe at any time with the link in each email.
• To measure and improve the website, our marketing and the Services.
• To detect, prevent and investigate fraud, abuse and security incidents.
• To comply with the law and to protect our rights.

We do not sell personal information for money. We share information only as follows:

• Service providers and sub-processors that help us run the Services, under written contracts. These include cloud hosting, voice and telephone carriers, AI model providers, insurance eligibility networks, messaging and email services, payment processing, analytics and support tools. Our current sub-processor list, with the country where each one processes data, is available at support@2care.ai.
• Systems that a customer connects, such as its EHR, practice management system, CRM or payer portals. We send data to these systems on the customer’s instructions.
• Advertising accounts that a customer connects. This feature is off by default. When a provider turns it on, we send hashed lead contact details only for people who gave the consent or HIPAA authorization that the law requires.
• Our affiliate in India, Billion AGI Pvt. Ltd., which provides engineering and support. Its staff access data only to support the Services, under access controls and confidentiality duties.
• Professional advisers, auditors and insurers, under confidentiality duties.
• Authorities, when the law requires it, or to protect the rights, safety or property of 2care, our customers or others.
• A buyer or successor in a merger, acquisition, financing or sale of assets, under protections equal to this policy.
• Anyone else, with your consent or at your direction.

• Providers use 2care to send appointment reminders, recall notices, follow-ups and other messages to their patients and leads. Messages are sent in the provider’s name, and the provider is responsible for consent.
• Message frequency varies. Message and data rates may apply.
• Reply STOP to stop texts from that provider at any time. You receive one text to confirm. Reply HELP for help.
• Providers set their sending windows. Messages go out only within the hours that federal and state law allow, in the recipient’s local time.
• We do not sell or share mobile phone numbers, SMS opt-in data or consent records with third parties for their own marketing.

Our website uses cookies and similar technologies in three groups. Choose which optional groups to allow with the Your Privacy Choices link at the bottom of every page.

• Necessary: these make the site work and remember your choices. They are always on.
• Analytics: Google Analytics and PostHog help us understand how visitors use the site. If you decline analytics, Google tags send only limited signals without cookies. PostHog measures basic site usage for all visitors, and it does not create a personal profile of you.
• Marketing: the Meta Pixel and Google Analytics advertising features measure our ads and help us show relevant ads to you on other sites.
• Embedded content, such as Vimeo videos and booking calendars, can set its own cookies. Form submissions go to HubSpot, our CRM.
• Browser signals: we treat a Global Privacy Control (GPC) signal as a request to opt out of the sale and sharing of your information for that browser. We do not respond to Do Not Track signals.
• The platform uses only the cookies it needs for login and security, plus PostHog product analytics linked to the staff account. On-screen text is masked, session recording is off, and we remove patient identifiers from page addresses before they are captured. We do not place advertising tags in the platform.

Depending on where you live, you can have the right to:

• Know what personal information we hold about you, and get a copy.
• Correct inaccurate information.
• Delete your information.
• Get your information in a portable format.
• Restrict or object to how we use your information.
• Opt out of targeted advertising, the “sale” or “sharing” of personal information, and certain profiling.
• Limit the use of sensitive personal information.
• Withdraw consent, where we rely on consent.
• Appeal our decision on your request.

• California, categories collected: in the last 12 months we collected identifiers, customer records, commercial information, internet and network activity, approximate location, audio recordings (demo and sales calls), professional information, and inferences from site use. Section 4 lists the sources, section 8 lists the purposes, and section 15 lists how long we keep each category.
• California, disclosures: we disclosed each of these categories for business purposes to the service providers in section 9. We “shared” identifiers and internet activity with advertising partners (Meta and Google) for cross-context behavioral advertising. To opt out, use Your Privacy Choices, send a GPC signal or email us. We do not sell personal information for money, and we do not knowingly sell or share the information of consumers under 16.
• California, sensitive personal information: we collect only account login credentials. We use them only to provide secure access, as the law permits, and not to infer characteristics about you.
• Other states: residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Jersey, New Hampshire, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other states with similar laws have the rights in section 12, subject to the exceptions in those laws. If we deny your request, you can appeal by replying to our decision. If we deny the appeal, you can contact your state attorney general.
• Consumer health data: Washington’s My Health My Data Act and Nevada’s consumer health data law protect some health data that HIPAA does not cover. We process consumer health data only for providers, on their instructions, and we do not sell it. Send requests about this data to the provider, or to us and we forward them.
• HIPAA data: state privacy laws generally do not apply to PHI that HIPAA governs. Your provider’s Notice of Privacy Practices explains your rights over that data.

• Website enquiries and sales records: 3 years after our last contact with you.
• Website analytics data: 14 months.
• Account and billing records: for the term of the customer agreement, and then 7 years for tax and accounting law.
• Call recordings and transcripts: for the period that the provider sets, and 12 months after the call by default. We then delete them automatically, including copies held by our voice providers.
• Other patient and message data: for the term of the customer agreement or as the provider instructs. When the agreement ends, we return or delete this data as the BAA or DPA requires.
• Raw insurance eligibility responses and insurance card images: 180 days. Voice-agent tool logs and system logs: 90 days. Inbound email: 30 days.
• Database backups: 14 days.

We protect information with administrative, technical and physical safeguards designed to meet the HIPAA Security Rule. No system is fully secure. If a breach affects personal information that we control, we notify you and the authorities as the law requires. If a breach affects patient data, we notify the provider without undue delay, so that the provider can meet its own deadlines. More detail is at 2care.ai/about/compliance.

• Encryption in transit and at rest, with additional field-level encryption for sensitive values, such as Social Security numbers and all integration credentials.
• Multi-factor authentication and automatic sign-out after inactivity for staff accounts.
• Role-based access and invite-only staff accounts.
• Audit logs of sign-ins, and of every view and change of patient records, calls and transcripts.
• Separate regional environments, so that each customer’s data is stored in one region.
• Confidentiality duties and security training for all our personnel.
• Our SOC 2 Type II audit is under way.

• We store customer data in the customer’s region: the United States for US customers, the European Union for UK and EU customers, and India for customers in India.
• Some sub-processors, such as voice, telephone and AI model providers, process data in the United States. Our sub-processor list shows the country for each one.
• Website data, such as HubSpot, Google Analytics, PostHog and Meta data, is processed in the United States.
• Our engineering and support staff in India can access data remotely to support the Services, under access controls, confidentiality duties and our agreements with customers.
• We protect international transfers with the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or another mechanism that the local law accepts.

• Controller: 2Care AI Inc., 8 The Green, Ste R, Dover, DE 19901, USA. Data Protection Officer: support@2care.ai.
• EU and UK representative: we appoint representatives under Article 27 of the EU GDPR and the UK GDPR. Contact them through support@2care.ai.
• Legal bases: we rely on contract to provide accounts, the Services and billing. We rely on legitimate interests for website security, analytics, business-to-business outreach and improving the Services. We rely on consent for marketing cookies and, where required, for marketing emails. We rely on legal obligation for tax records and lawful requests.
• You have the rights in section 12, including the right to restrict processing and to object to processing based on legitimate interests and to direct marketing.
• We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
• You can complain to the UK Information Commissioner’s Office or to the data protection authority where you live.
• For customers, our Data Processing Agreement sets out our duties as processor.

• Where the Digital Personal Data Protection Act, 2023 and its Rules apply, we process your personal data with your consent or for the legitimate uses that the Act permits.
• You can get a summary of your data, correct, complete, update or erase it, withdraw consent, and nominate another person to use your rights. Where a registered consent manager is available, you can also give and withdraw consent through it.
• Grievance officer: Data Protection Officer, support@2care.ai. We answer grievances within 90 days. If we do not resolve your grievance, you can complain to the Data Protection Board of India.
• In India, a child is a person under 18. We do not process a child’s personal data for our own purposes without verifiable consent from a parent or lawful guardian.
• For customers, the provider is the data fiduciary for patient data, and 2care is its data processor.

This section applies to people in Singapore, Australia, Malaysia, the Philippines, Hong Kong, Japan and New Zealand, in addition to the rest of this policy.

• Our role: for patient data, 2care is a data intermediary or processor, and the provider decides how the data is used. Our APAC Data Processing Agreement (2care.ai/legal/apac/dpa) sets out our duties to providers. For website and sales data, 2care decides.
• Consent and purpose: we collect personal data with your consent or as the law permits, for the purposes in section 8. You can withdraw consent at any time.
• Overseas transfers: we transfer personal data to the United States, the European Union and India. We protect each transfer with contracts that give a standard of protection comparable to your local law.
• Marketing in Singapore: before we send marketing calls or texts to Singapore numbers, we check the Do Not Call Registry. You can opt out at any time.
• Identity checks: we do not use Singapore NRIC numbers to verify identity.
• Your rights: you can ask to access and correct your personal data and to withdraw consent. We answer within 30 days.
• Data Protection Officer: support@2care.ai, or 2Care AI Inc., 8 The Green, Ste R, Dover, DE 19901, USA.
• Breaches: if a breach affects patient data, we notify the provider fast enough for it to meet its own deadlines, including the two-hour notice to the Ministry of Health under Singapore’s Health Information Act.
• Complaints: you can complain to the Personal Data Protection Commission (Singapore), the Office of the Australian Information Commissioner, the Personal Data Protection Commissioner (Malaysia), the National Privacy Commission (Philippines), the Privacy Commissioner for Personal Data (Hong Kong), the Personal Information Protection Commission (Japan) or the Office of the Privacy Commissioner (New Zealand).