Snapback Health Technologies LLC ("Snapback Health," "we," "us," or "our") is committed to protecting the privacy and security of your personal and health information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our patient recovery portal at snapbackhealth.com and app.snapbackhealth.com (the "Service").
We act as a Business Associate under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") to your healthcare provider, and we are committed to the protection of Protected Health Information ("PHI") in accordance with HIPAA, the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and applicable state privacy laws.
We collect the following categories of information when you use our Service:
Push notifications: If you enable push, we process a browser/device subscription endpoint and associated delivery keys, account association, and notification preferences. These support delivery and subscription management.
Sources and future EMR connections: Information may come from you, your authorized care team, or an authorized caregiver. If a clinic-approved EMR connection is implemented and enabled, we may receive permitted patient/chart identifiers, diagnoses, medication information, appointments, and other clinical information within its approved scope. Oracle Health/Cerner and athenahealth connections are planned; this Policy does not mean they are currently active. Data sharing back to an EMR requires a separately enabled and authorized workflow.
We use your information solely for the following purposes:
We do not use your information for advertising, marketing to third parties, or sale to data brokers.
We do not sell your personal information or health data to any third party under any circumstance. We share your information only in the following limited circumstances:
AI processing: When you use an AI feature, relevant text, recovery context, or an image may be processed by the service providers operating that feature. Efforts to reduce unnecessary identifiers do not guarantee that text or images contain no identifying information. Do not include unrelated identifiers or another person's information. Authorized processing remains subject to the purposes and restrictions described in this Policy.
Notification delivery: Enabled SMS, email, and push channels require sharing delivery information with the providers supporting that channel. Notifications may be visible on a lock screen or shared device. Device permission does not guarantee delivery or clinician review. Service-related account or security notices are distinct from optional recovery reminders.
If you choose to receive SMS reminders, you explicitly consent to receive automated text messages from Snapback Health at the mobile number you provide.
SMS reminders require an affirmative opt-in; merely creating an account or providing a phone number is not consent to receive them. We record SMS consent and preference changes. You can decline optional reminders without declining clinical care. Provider alert messaging, if enabled, is governed by its own enrollment and channel preferences.
A complete description of our SMS reminder program, including a visual demonstration of the opt-in flow, is available at snapbackhealth.com/sms-opt-in.
We use technical and organizational measures designed to protect health information, including HTTPS connections to the portal, authentication, access controls, and security-event logging. Safeguards depend on the service and data involved; these statements are not a claim that every action is logged or that every possible threat is prevented.
No electronic system is completely secure. Protect your credentials, sign out on shared devices, and report suspected unauthorized access to john.oshea@snapbackhealth.com. SMS, email, and lock-screen previews may expose information outside the authenticated portal.
Retention depends on the information involved, the purpose for which it was collected, applicable law, and our agreements with your clinic. Closing an account or withdrawing notification permission does not automatically delete clinical records.
To request account closure, deletion, or information about the retention period applicable to your records, email john.oshea@snapbackhealth.com. We may need to verify your identity and coordinate with your clinic. We will explain applicable limits on a request.
Your rights depend on applicable law and the role in which Snapback processes your information. For records maintained for your healthcare provider, that provider generally manages HIPAA requests; we assist as required by law and our agreement with the provider.
These rights may include requesting access or copies, requesting an amendment, requesting restrictions or confidential communications, and an accounting of certain disclosures. Not all requested restrictions must be accepted, and an accounting does not include every routine use or disclosure. You may also have deletion or other rights under applicable state law, subject to exceptions.
Contact your clinic or john.oshea@snapbackhealth.com. We may verify identity or representative authority and direct or coordinate the request with your clinic. Applicable response deadlines and permitted extensions vary by request; there is not one universal 30-day deadline for every privacy right.
You may complain to us or the U.S. Department of Health and Human Services Office for Civil Rights without retaliation. Using the Service does not waive privacy rights.
A minor's participation requires confirmation by the clinic and Snapback that an appropriate enrollment, consent, and access workflow is available. Do not create an independent child account or submit a child's information before that confirmation. For children under 13, any permitted enrollment must be managed by an authorized parent or guardian, with applicable consent and verification requirements completed before collection. We do not treat a clinic code as proof of parental authority or consent.
Rules for adolescent consent and parent or guardian access depend on applicable law and the care involved. Access must respect those rules. Caregiver access requires an authorized arrangement and is not established by sharing credentials. If you believe a child's information was collected without appropriate authorization, contact us so we can investigate and take appropriate action.
The Service is intended for use by patients of healthcare providers located in the United States. We do not market the Service to individuals outside the United States. If you access the Service from outside the United States, you do so at your own risk and acknowledge that your information will be processed in the United States in accordance with U.S. law.
We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or industry standards. We will notify you of material changes by email to your registered address or through a prominent notice in the patient portal at least thirty days before changes take effect. We will obtain additional consent when required by law. Continued use alone does not authorize a new use or disclosure that requires separate consent. Changes do not remove protections that continue to apply to previously collected information.
State laws, including California privacy and medical-information laws where applicable, may provide additional rights. Coverage and exemptions depend on the entity, information, and processing involved; not every law applies to every record. Rights may include access, correction, deletion subject to exceptions, and information about collection or disclosure.
We do not sell personal information or share it for cross-context behavioral advertising. To submit a request or ask about applicable rights, contact john.oshea@snapbackhealth.com. We may verify your identity and the authority of a representative. We will not unlawfully discriminate against you for exercising your rights.
If you have questions about this Privacy Policy, our privacy practices, or how we handle your health information, or to exercise any of your rights, please contact our Privacy Officer:
You may also file a HIPAA complaint with the U.S. Department of Health and Human Services Office for Civil Rights at https://www.hhs.gov/hipaa/filing-a-complaint/index.html.