Privacy Policy

1. SCOPE AND APPLICABILITY

This Privacy Policy applies to:

• Visitors to our website and digital platforms
• Healthcare providers, clinics, and pharmacies using our services
• Patients whose health information is processed through our platform
• Business associates and third-party vendors
• All data processing activities conducted by AutoPilot Technologies, LLC

Regulatory Compliance: This policy is designed to comply with HIPAA, state privacy laws (including California's CCPA/CPRA), GDPR for EU users, and other applicable privacy regulations.

2. INFORMATION WE COLLECT

2.1 Information You Provide Directly

• Identity Information: Name, title, professional credentials, contact information
• Professional Information: NPI numbers, DEA numbers, medical licenses, institutional affiliations
• Account Information: Username, password, security questions, account preferences
• Communication Data: Messages, support requests, feedback, survey responses
• Billing Information: Payment details, billing addresses, transaction history
• Prescription Data: Medication information, dosages, patient identifiers, prescribing history

2.2 Automatically Collected Information

• Technical Data: IP addresses, device identifiers, browser type and version, operating system
• Usage Analytics: Pages visited, time spent, click patterns, feature usage, session recordings
• Location Data: General geographic location based on IP address
• Cookies and Tracking: Session cookies, preference cookies, analytics cookies, and similar technologies

2.3 Protected Health Information (PHI)

As a HIPAA Business Associate, we may collect, process, and store PHI including:

• Patient demographics and contact information
• Medical history and treatment records
• Prescription and medication data
• Health insurance information
• Clinical notes and assessments
• Diagnostic information and test results

3. HOW WE USE YOUR INFORMATION

3.1 Service Delivery and Operations

• Providing our healthcare technology platform and services
• Processing prescriptions and facilitating healthcare workflows
• Maintaining and improving system functionality
• Providing customer support and technical assistance
• Conducting system maintenance and updates

3.2 Communications

• Sending service-related notifications and updates
• Responding to inquiries and support requests
• Providing training and educational materials
• Delivering marketing communications (with consent where required)

3.3 Legal and Regulatory Compliance

• Complying with HIPAA, FDA, DEA, and other healthcare regulations
• Responding to legal process and government requests
• Conducting internal audits and compliance monitoring
• Reporting adverse events or safety concerns as required

3.4 Analytics and Improvement

• Analyzing usage patterns to improve our services
• Conducting research and development (using de-identified data)
• Monitoring system performance and security
• Generating aggregate reports and statistics

We do not sell, rent, or trade your personal information or PHI for commercial or marketing purposes. Any third-party service providers we engage to support our operations are bound by Business Associate Agreements or equivalent data protection agreements.

4. LEGAL BASES FOR PROCESSING (EU/EEA USERS)

For users in the European Union/European Economic Area, our legal bases include:

• Consent: Where you have provided explicit consent
• Contract Performance: To fulfill our contractual obligations
• Legal Compliance: To comply with applicable laws and regulations
• Legitimate Interests: For business operations, security, and service improvement
• Vital Interests: To protect life or prevent serious harm

5. WE DO NOT SELL OR SHARE YOUR INFORMATION

5.1 Our Firm Commitment

AutoPilot Technologies does not sell, rent, or trade your personal information for commercial or marketing purposes.

• We do not sell your personal information
• We do not share your data with marketing companies or advertisers
• We do not provide your information to data brokers
• We do NOT have affiliates or partners that receive your information for marketing or commercial purposes
• We do not share your information with third-party analytics companies for marketing purposes

5.2 Limited Legal Exceptions

The only circumstances under which we may disclose information are when legally compelled:

• Valid court orders or subpoenas that legally require disclosure
• Legal requirements under healthcare regulations (HIPAA, FDA, DEA)
• Imminent threats to life or safety where disclosure is legally mandated

Even in these circumstances, we will limit disclosure to the minimum necessary and will notify you when legally permitted to do so.

5.3 Your Data Stays With Us

All data processing is conducted in accordance with our HIPAA obligations. Where we engage third-party service providers (such as cloud infrastructure, payment processing, or pharmacy management systems) to support our operations, those providers are bound by Business Associate Agreements or equivalent data protection agreements and are prohibited from using your information for any purpose other than providing services to AutoPilot. We do not share your information with any third party for commercial or marketing purposes.

6. DATA SECURITY AND PROTECTION

6.1 Technical Safeguards

• End-to-end encryption for data transmission using SSL/TLS (Secure Socket Layer/Transport Layer Security)
• Advanced encryption standards (AES-256) for data at rest
• Multi-factor authentication for all user accounts
• Regular security assessments and penetration testing
• Intrusion detection and prevention systems

6.2 Administrative Safeguards

• Comprehensive workforce training on privacy and security
• Role-based access controls and least privilege principles
• Regular security audits and risk assessments
• Incident response and breach notification procedures
• Business Associate Agreements with all vendors

6.3 Physical Safeguards

• Secure data centers with restricted access
• Environmental controls and monitoring
• Backup and disaster recovery procedures
• Secure disposal of electronic media

7. DATA RETENTION

7.1 General Retention Periods

• Personal Information: Retained for the duration of the business relationship plus 7 years
• PHI: Retained as required by HIPAA and applicable state laws (typically 6-10 years)
• Usage Data: Retained for up to 3 years for analytics purposes
• Communication Records: Retained for 7 years for legal compliance

7.2 Deletion and Disposal

Upon expiration of retention periods, we securely delete or anonymize data using industry-standard methods.

8. YOUR PRIVACY RIGHTS

8.1 HIPAA Rights (for PHI)

• Right to Access: Request copies of your health information
• Right to Amend: Request corrections to inaccurate information
• Right to Restrict: Request limitations on use and disclosure
• Right to Accounting: Receive a list of disclosures made
• Right to Complain: File complaints with us or the HHS Office for Civil Rights
• How to File: To file a complaint with the U.S. Department of Health and Human Services, visit hhs.gov/ocr or call 1-800-368-1019.

8.2 General Privacy Rights

• Right to Know: What personal information we collect and how we use it
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate information
• Right to Opt-Out: Opt out of certain processing activities
• Right to Data Portability: Receive your data in a portable format

8.3 California Privacy Rights (CCPA/CPRA)

California residents have additional rights including the right to opt-out of the sale of personal information and the right to non-discrimination.

8.4 EU/EEA Rights (GDPR)

EU residents have additional rights including the right to object to processing and the right to lodge complaints with supervisory authorities.

To exercise your rights, contact us at: privacy@autopilotrx.com

9. INTERNATIONAL DATA TRANSFERS

For international users, we may transfer your information to the United States and other countries. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs)
• Adequacy decisions where applicable
• Other appropriate safeguards as required by law

10. COOKIES AND TRACKING TECHNOLOGIES

10.1 Types of Cookies We Use

We only use cookies that are necessary for our service. We do NOT use any third-party tracking or advertising cookies:

• Essential Cookies: Required for basic website functionality and security
• Preference Cookies: Remember your settings and preferences

We do NOT use marketing cookies, advertising trackers, or any third-party analytics that share your data externally.

10.2 Cookie Management

You can manage cookies through your browser settings. Note that disabling essential cookies may affect website functionality.

11. EXTERNAL LINKS

Our website may contain links to external websites for your convenience. These links are provided for informational purposes only. We do not share any of your data with these external websites, and clicking such links does not transmit your information to them from our platform.

12. CHILDREN'S PRIVACY

We do not knowingly collect personal information from individuals under 18 years of age. If we learn that we have collected such information, we will promptly delete it.

13. UPDATES TO THIS POLICY

We may update this Privacy Policy periodically to reflect changes in our practices or applicable laws. Material changes will be communicated through:

• Email notifications to registered users
• Prominent website notices
• Direct communication for significant changes

14. CONTACT INFORMATION