— Legal

Privacy Policy

Last updated October 20, 2026

This Privacy Policy describes how Xyntheon, Inc. ("Xyntheon", "we", "us", or "our") collects, uses, shares, and protects information in connection with our websites, the Xyntheon platform, the Xyntheon app for iPhone (the "App"), and our related products and services (collectively, the "Services"). By using the Services you agree to the practices described in this Policy.

1. Who This Policy Covers

Xyntheon makes software that healthcare practices ("Practices") use to run their patient communications, clinical operations, and front and back office work. This Policy covers:

  • Visitors and business contacts. People who visit our websites, contact us, or subscribe to our updates.
  • Staff users. Employees and contractors of a Practice who use the Xyntheon platform in a web browser or in the App. A Practice creates its staff accounts; the App is not open to the public.
  • Patient information. Information about a Practice's patients that staff enter into, or receive through, the platform. We handle it on the Practice's behalf as protected health information ("PHI"), as described in Section 4. If you are a patient, your Practice's Notice of Privacy Practices explains how your health information is used, and your Practice is the right place to send requests about it.

2. Information We Collect From Our Websites and Communications

We collect information that you provide directly to us, including:

  • Contact information. Name, email address, phone number, clinic or organization, and role, when you submit our contact form or request information.
  • Communications. The contents of messages you send to us, including support requests and inquiries.
  • SMS opt-in records. When you check the SMS consent checkbox, we record your consent timestamp along with your phone number.
  • Newsletter signups. Email address and any other information you provide when subscribing.

We also automatically collect limited technical information, including a hashed IP address, user-agent string, and referring URL, used to prevent abuse of our forms and to operate the Services securely.

3. Information We Collect Through the Platform, the App, and the Patient Portal

Account information

When a Practice adds you as a staff member, we keep your name and work email address as the Practice's administrator entered them, your role, and the Practices you belong to. You sign in with Google: we receive your Google account identifier, name, and email address through Google Sign-In and Firebase Authentication. We never receive your Google password.

Information you enter or send

The platform stores what staff enter or send so that the Practice can do its work. This includes:

  • Patient contact details: names, phone numbers, email addresses, and postal addresses.
  • Clinical information, such as allergies, medications, conditions, encounters, chart notes, and documents.
  • Text messages, multimedia messages, and emails sent to and from patients, and call transcripts.
  • Photos you take or choose for a message, chart, or task, and documents you upload. The App does not accept video.
  • Internal notes, tasks, comments, and forms.
  • Records of patient purchases, such as packages, card charges, payment events, and invoices.
  • Payment cards entered in the card form. Card details go directly to Stripe, and we keep only the card brand and last four digits (see Section 6).
  • Searches and requests you type into the command bar (⌘K), which are kept in your session history.

Entries are stored with the identity of the staff member who made them.

Calls

Outbound calls placed from the platform, including from the App, are recorded, with the patient and the staff member on separate channels, and transcribed into the patient's conversation thread for the Practice's records.

Inbound calls are not recorded. The only inbound audio we keep is a voicemail: when a caller leaves one, it is recorded and stored in the patient's conversation thread, where it may also be transcribed.

We also store voicemail greetings and phone prompts that staff record. Call audio is carried by Twilio and LiveKit (see Section 6).

Device and usage information

  • Push notifications. If you turn on notifications, we store your device's push tokens (Firebase Cloud Messaging and Apple push tokens) so that we can alert you to new messages, tasks, approvals, and incoming calls. Notifications are opt-in, and you can turn them off at any time.
  • Install identifier. The App creates a random identifier for each installation and uses it to route an answered call to the right device.
  • Access logs. As HIPAA requires, we log each time staff view or search patient records, with the staff member's identity, the time, the IP address, and the browser or device user agent.
  • Diagnostics. We record limited technical events, such as call-screen transitions and the first time you join an incoming call, to keep calling reliable. When you join a call, the calling software sends your device model, operating system, network type, and (in a browser) browser to LiveKit. Google's Firebase software in the App sends Google limited technical data about its own health and performance, not linked to you.

What the App does not collect

The App does not collect your precise location, your contacts, your browsing history outside the App, or crash reports, and it does not use Apple's advertising identifier. It asks for the camera and photo library only when you take, choose, or save a photo, and for the microphone only when you place or answer a call or record a greeting.

The patient portal

Patients do not have accounts or passwords. A Practice's patients use the Xyntheon patient portal, a website at app-portal.xyntheon.com, to book visits, fill in forms, sign documents, check in, and send documents to their Practice. The portal is separate from the App.

  • How patients reach it. Patients open the portal through secure links their Practice sends by text message or email. The portal also offers sign-in with a mobile number and a texted code. Each link is long, random, and time-limited, and we store most links only in hashed form.
  • How patients confirm who they are. Before the portal shows a patient's information or accepts their answers, signatures, or bookings, the patient enters a six-digit code that we text to the mobile number their Practice has on file. Codes expire after 10 minutes, and five wrong tries lock the code. Online scheduling and front-desk check-in also ask for the patient's date of birth before the code is sent. A few links work without a code because they show no health information or only send something to the Practice: calendar invitations, the Practice's contact card, general Practice documents, document-upload links, and signing sessions that staff open for the patient on a device in the office.
  • What the portal collects. Depending on the features the Practice uses:
    • Appointment choices: the visit type, provider, location, and time, and any request for a later date.
    • Form and intake answers, which can update the patient's record, for example contact details, date of birth, address, emergency contact, pharmacy, and health history.
    • Documents and photos the patient uploads, including a photo of a driver's license where the Practice asks for one.
    • Electronic signatures on consents and policies, kept with the signed document, the signature image, the typed name, the date and time, the IP address, and device and browser details.
    • Contact details, and text message and email preferences.
    • Check-in confirmations.
  • Payments. Card details for a deposit or a card on file are entered directly into Stripe's card form and go to Stripe, under the Practice's own Stripe account. We keep only the card brand, the last four digits, and the expiry date.
  • Identity verification. If a Practice requires identity verification, the patient completes it on the verification provider's own page (Didit). We receive only the result, such as whether the checks passed and the type of document, and we do not store images of the ID.
  • Technical information. We keep a record of each code we send, with the code in hashed form, its expiry, the number of attempts, and the mobile number it went to. When a patient signs a document, and whenever the portal reads or updates their record, we log the IP address and device and browser details, for security and for the access records HIPAA requires. The portal sets no cookies; it keeps short-lived session information in the browser's own storage. The portal does not use advertising, analytics, or session-recording tools. Where it is turned on, the sign-in page uses Cloudflare Turnstile, a security check that blocks automated sign-in attempts.
  • Whose information it is. Information patients submit through the portal becomes part of their Practice's records, is kept separately for each Practice, and is handled as PHI under Section 4. Patients should ask their Practice about access to, correction of, or deletion of that information.

4. Protected Health Information

  • Practices are covered entities under HIPAA. Xyntheon acts as their business associate. We handle PHI only to provide the Services to the Practice, under a business associate agreement with that Practice and as HIPAA permits.
  • Patient information shown to staff in the App comes from the Practice's own records. Access is limited to the Practice's authorized staff, and each access is logged.
  • Each Practice's information is kept separate. One Practice cannot see another Practice's information.
  • We do not sell PHI, use it for advertising or marketing, or share it with data brokers.
  • We have business associate agreements with the service providers that handle PHI for us, including the AI providers named in Section 6. Each of them must protect PHI as HIPAA requires.
  • Patients who want to see, correct, or get a copy of their health information, or to learn how it has been shared, should contact their Practice. If a patient contacts us, we will refer the request to the Practice.

5. How We Use Information

We use the information we collect to:

  • Respond to inquiries and provide the Services you request
  • Provide the platform and the App to Practices and their staff, including sign-in, messaging, calling, scheduling, records, tasks, and payments
  • Send push notifications you have turned on
  • Draft replies, answer command-bar requests, transcribe calls, and generate speech with the AI providers described in Section 6
  • Send SMS messages you have explicitly opted into, including account notifications, support and operational communications, scheduling and appointment confirmations, and responses to requests you initiated
  • Send transactional email and newsletters you have subscribed to
  • Operate, maintain, secure, and improve the Services, including detecting and preventing fraud and abuse and keeping the audit records HIPAA requires
  • Comply with legal obligations and enforce our Terms

6. Service Providers and Software in the App

We use the following providers to run the platform and the App. Each receives only the information it needs for the service it performs, and each provider that handles PHI does so under a business associate agreement with Xyntheon.

  • Google. Google Cloud hosting, database, and file storage. Firebase Authentication and Google Sign-In for staff sign-in. Firebase Cloud Messaging for push notifications. Gmail, when a Practice connects its mailbox. Speech-to-Text and Vertex AI for transcription and AI features. Google Sign-In estimates an approximate location from your IP address to protect sign-in against fraud, and Google's sign-in and Firebase software may use limited identifiers, usage data, and diagnostic data for Google's own analytics, as described in Google's Privacy Policy.
  • Apple. The Apple Push Notification service delivers notifications and incoming-call alerts to the App.
  • Twilio. Text and multimedia messages, phone calls, call recording, and transcription.
  • LiveKit Cloud. Carries live call audio for calls in the App and in the browser. LiveKit keeps a record of each call session: your participant identifier, your work email as your display name, join and leave times, connection time and quality, device model, operating system, browser, software version, and approximate location.
  • Stripe. Processes payment cards that staff enter in the card form. Card details go directly to Stripe. While the card form is open, Stripe's software also collects device characteristics and activity signals, such as mouse activity and time on the page, which Stripe keeps for as long as they are useful for fraud detection and security. Stripe states that this data is never used for advertising and is not rented, sold, or given to advertisers.
  • AI providers: Anthropic, OpenAI, xAI, and ElevenLabs. Power reply drafting, the command bar (⌘K), and generated speech. They receive the text or audio needed for each request. In command-bar requests, patient names are replaced with internal reference codes before the text is sent to the AI provider.

7. How We Share Information

We do not sell your personal information, and we do not share it for targeted advertising. We share information only with:

  • Your Practice. Information you enter in the platform is available to authorized people at your Practice, and records of your activity there, such as access logs, are kept for the Practice.
  • Service providers. The providers named in Sections 3 and 6, and providers who help us operate our websites (for example, hosting, database, transactional email, and analytics providers), under contractual obligations of confidentiality and security.
  • Legal and safety. Where required by law, legal process, or to protect the rights, property, or safety of Xyntheon, our users, or others.
  • Corporate transactions. In connection with a merger, acquisition, financing, or sale of assets, where information is transferred subject to this Policy.

8. Tracking and Advertising

Xyntheon does not track you. We do not use information from the App or the platform for targeted advertising, we do not share it with data brokers, and we do not combine it with information from other companies' apps or websites for advertising. We do not add advertising, analytics, or session-replay software to the App or the platform; the only analytics use is that of Google's own sign-in and Firebase software, described in Section 6. The App does not use Apple's advertising identifier and does not ask for permission to track you.

9. SMS Messaging Data

This section covers text messages that Xyntheon sends to you after you opt in. Text messages a Practice sends to its patients through the platform are sent on the Practice's behalf and are covered by Sections 3 and 4.

If you provide your phone number and check the SMS consent checkbox, we will send you SMS messages from Xyntheon at the number you provided. SMS opt-in data and consent records are not shared with third parties or affiliates for marketing purposes. Mobile information is used solely to operate the SMS program you opted into.

You can opt out of SMS messages at any time by replying STOP to any message. For help, reply HELP or email hello@xyntheon.com. Message frequency varies. Message and data rates may apply. See our Terms of Service for full SMS terms.

10. Data Retention

We retain information for as long as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Contact form submissions are retained while we maintain an active business relationship and for a reasonable period thereafter.

Platform information is kept while the Practice uses the Services, and afterward as the Practice's agreement with us and the law require. Medical records, and the records HIPAA requires us to keep, such as access logs, are kept for the full retention period that HIPAA and state law require, and are not deleted before that period ends. Stripe and LiveKit keep the information described in Section 6 under their own retention policies.

You may request deletion of your information at any time by emailing hello@xyntheon.com. Information that HIPAA or other law requires us to keep is deleted only after its retention period ends. Staff users can decommission their account as described in Section 11.

11. Your Account and Decommissioning It

Your Practice creates and manages your staff account.

  • Stop using the App. You can sign out at any time and delete the App from your device.
  • End access. A Practice administrator can remove a staff member in the platform (Team › Remove from team). That person's sign-in stops working right away.
  • Decommission your account. In the App or the web app, open Settings › About › Decommission your account, or email hello@xyntheon.com from your work address. We will confirm the request with your Practice and then decommission your account: your sign-in stops working and the account is closed. Because the platform holds medical records, we keep the account's records for the full retention period that HIPAA and state law require, and we do not delete them before that period ends. These include entries you made in patient records and the access logs HIPAA requires, which belong to the Practice's records.
  • Patients. Patients do not have accounts. They use the patient portal through links their Practice sends, as described in the Patient portal section; requests about patient information go to the Practice (see Section 4).

12. Security

We use administrative, technical, and physical safeguards designed to protect your information against unauthorized access, disclosure, alteration, and destruction. The App and the platform connect to our servers only over encrypted (HTTPS) connections, and the platform stores information on Google Cloud, which encrypts data at rest. No method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

13. Your Rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. Records that HIPAA or other law requires us to keep are deleted only after their retention period ends (see Sections 10 and 11). To exercise these rights, email hello@xyntheon.com. Patients should send requests about their health information to their Practice (see Section 4).

14. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. A Practice may enter information about patients of any age, including children, as part of their care; that information is handled as PHI under Section 4.

15. Changes to This Policy

We may update this Policy from time to time. The most current version will always be posted on this page with the date it was last updated. Material changes will be communicated through the Services or by other reasonable means.

16. Contact

Questions about this Privacy Policy? Contact us at hello@xyntheon.com.