Privacy Policy

This Privacy Policy explains how Miltinson Technologies LLC (“Miltinson,” “we,” “us”) collects, uses, shares and protects information in connection with AlderHealth, a clinical operations platform for medical practices (the “Service”), and the public website that describes it.

The Service is sold to medical practices (“Customers”). It is not offered to patients, and patients do not have accounts. When we handle patient information, we do so on behalf of the Customer that provided it. The Customer’s own notice of privacy practices governs how it uses and discloses that patient information.

The Service has not launched. It runs today on a test environment with sample data. No patient information may be entered into it until the Customer has signed a business associate agreement with us, and we have signed business associate agreements with the providers that would handle that information (section 6 and section 13). None of those agreements is signed yet. This policy will be updated before launch.

1. Who we are and what this policy covers

The Service is operated by Miltinson Technologies LLC, a Washington limited liability company. Our contact details are in section 16.

This policy covers:

• visitors to our public website;
• people who sign in to the Service: clinicians, practice administrators and staff of the adult family homes a Customer serves;
• patient representatives (for example, a health care power of attorney) who receive a visit note through a secure one-time link; and
• patients whose information a Customer enters into, or receives through, the Service.

Where we have signed a written agreement with a Customer, including a business associate agreement, that agreement controls if it conflicts with this policy.

2. Information we collect

Account information

For each person who signs in: name, work email address, role, and the practice the account belongs to. Sign-in is handled by Neon Auth, a service of our database provider, Neon. Neon Auth keeps the credentials for your account and emails you a code that confirms your address. Our servers pass the password you type to Neon Auth and do not store it.

Patient information (on behalf of Customers)

A Customer’s staff enter patient information, and the Customer may connect other systems that send it to us. Depending on which features the Customer uses, this includes:

• identity and demographics: name, date of birth, Medicare identifier and the adult family home where the patient lives;
• the patient’s representative: name, phone number and health care power of attorney documents;
• clinical records: visits, visit notes, diagnoses, diagnosis and billing codes, clinical assessment scores, medications and prescriptions, and care plans;
• care management records, such as chronic care, behavioral health and transitional care episodes, and time logged against them;
• hospital admission, discharge and transfer events;
• readings from remote patient monitoring devices;
• documents and faxes, which the Service stores and does not read today;
• care coordination messages between staff; and
• voice dictation. Audio is sent for transcription and discarded; we do not store it.

Practice and facility information

Practice settings, provider directory entries, adult family home names, addresses and map coordinates, visit schedules and routes, and clinician mileage logs.

Credentials for connected systems

When a Customer connects its own account with an electronic health record or device vendor, we store the access tokens and secrets that vendor issues. They are encrypted before they are written to our database.

Technical and audit information

For each request to the Service we record the time, the page or function requested (not its contents), the result, the IP address, and the account and practice identifiers. We keep an audit trail of who viewed, changed, signed or delivered a record.

When document classification, document summarization or visit note drafting runs, we record the AI model used, how much it was used, its cost, and which patient and provider it concerned. We do not log the text sent to or returned by any AI model.

Information stored on your device

• Cookies that keep you signed in. They are required for the Service to work.
• Display preferences, such as light or dark mode, in your browser’s storage.
• Visit note drafts saved for offline use, in your browser’s storage. They are deleted when you sign out on this device.
• Cached copies of the application’s icons and of the pages you open, so the Service can show something when you are offline. Patient records are loaded separately and are not cached this way.

Website visitors

Our website does not use analytics, advertising or tracking scripts. Our hosting provider receives standard request information, such as your IP address, to deliver the page. Technical reports go to our error-monitoring provider: one when a page fails, and timing reports for a sample of page loads. What that report holds is described in section 6.

3. How we use information

We use information to:

• provide the Service to the Customer and the people it authorizes;
• carry out the functions the Customer turns on, such as drafting notes, suggesting codes, summarizing documents, delivering signed notes and syncing with its other systems;
• authenticate users, secure the Service and investigate misuse;
• keep audit records and meet our legal obligations;
• measure usage for billing and capacity; and
• respond to support requests.

We use patient information only to provide the Service to the Customer that supplied it. We do not sell personal information, use it for targeted advertising, or use patient information to market to anyone.

4. AI features

Some features use large language models provided by Anthropic: classifying incoming documents and matching them to a patient, summarizing documents, drafting visit notes, translating notes, answering clinical evidence questions, and summarizing care. Document classification and matching is on whenever AI is configured for the deployment; each of the others is off unless it is turned on. Document classification, matching and summarization need the text of a document. The Service does not read that text today, so these three do not run.

• Before text is sent to the model, a filter removes the patient identifiers it can detect that the feature does not need. It cannot detect every identifier: names written in a document’s own text can reach the model and can appear in a summary.
• Document matching is sent patient names and dates of birth, because matching needs them. The patient list it is sent never includes Medicare identifiers, and the filter removes any it detects.
• AI output is a draft. Nothing an AI feature produces is signed, billed or delivered until a person reviews and accepts it.
• We do not use Customer or patient information to train AI models.

5. How we share information

We share information only in these cases:

• With the Customer and the people it authorizes. Access inside a practice depends on role. Adult family home staff see only the notes delivered to their home.
• Where the Customer directs it. For example, a signed note is written back to the Customer’s electronic health record when that connection is on, or delivered to a patient’s representative through a secure link.
• With the service providers listed in section 6, which process information on our behalf.
• For legal reasons: to comply with law, a court order or a lawful request from a government authority, or to protect the rights, safety or property of our users, patients, the public or us.
• In a business transfer, such as a merger or sale of assets, subject to the commitments in this policy and in our Customer agreements.

6. Service providers (subprocessors)

Before launch, the Service runs on the providers below. We have not signed a business associate agreement with any of them, which is one reason no patient information may be entered yet. Some are used only when a Customer turns on the matching feature or connects its own account.

• Vercel (United States): hosts the website and the Service, and stores uploaded documents (Vercel Blob).
• Neon (United States): database hosting, and sign-in (Neon Auth). For sign-in it stores each account’s email address and password, and sends the code that confirms an email address.
• Upstash (United States): request rate limiting. Receives practice identifiers and IP addresses, not patient records.
• Anthropic (United States): the AI features in section 4.
• Sentry (United States): error and performance monitoring for the web pages of the website and the Service. Receives technical reports of software errors, and of how long a sample of page loads and requests took: the type of error, where in our code it happened, the address pattern of the page and of the requests it made, with record identifiers removed, the response status, timings and the browser type. It does not receive an error’s message, page contents, cookies, your identity or your IP address.
• Deepgram: voice transcription, if the Customer chooses it for dictation. We ask Deepgram not to use dictation audio to improve its models; we have not yet confirmed its data terms in a signed contract.
• Twilio: text messages carrying the one-time code a patient’s representative uses to open a secure link. Receives the representative’s phone number. Used only once text messaging is turned on for the deployment.
• Google Maps Platform: travel times between adult family homes, if the Customer uses route planning. Receives the map coordinates of adult family homes, which are where patients live. Also looks up the coordinates of a practice’s own office address when a practice administrator saves it. Receives that business address only.
• Systems the Customer connects under its own account with that vendor: DrChrono (electronic health record), PointClickCare (hospital and facility events), Tenovi (remote monitoring devices) and Updox (fax). The e-prescribing connection (DoseSpot) is in development and sends no information today.

If the Customer’s clinicians use their web browser’s built-in speech recognition for dictation, the browser maker may process that audio under its own terms.

We will update this list before we add or replace a provider, and before any provider begins processing patient information.

7. Where information is stored

We store and process information primarily in the United States. The Service is intended for use in the United States.

8. How we protect information

We use reasonable administrative, technical and physical safeguards. They include:

• encryption in transit: the Service is served only over HTTPS, and our database connections are configured to use verified TLS;
• stored documents encrypted at rest by our hosting provider, with keys it manages, and AES-256-GCM encryption for the credentials Customers give us for their connected systems;
• each practice’s data kept separate by the database itself, which refuses to return one practice’s rows to another;
• role-based access inside each practice;
• no sign-up on this site: the Service gives access only to a person a practice has added to its directory, or whom we have set up;
• sign-in with an email address and a password, and a one-time code emailed to confirm the address. The Service does not offer multi-factor authentication today;
• an audit trail of access to patient records, which the application has no function to edit or delete;
• application logs that exclude request and response contents;
• secure note delivery to patient representatives through links that expire after 72 hours and require a one-time code sent by text message; and
• rate limiting, and the ability to suspend a practice’s access during an incident.

No system is perfectly secure, and we cannot guarantee the security of information.

9. Security incidents and breach notification

If we discover a security incident affecting information we handle, we will act to contain it, investigate it, and notify affected parties as required by law and by our agreements.

• For patient information we handle on a Customer’s behalf, we will notify the Customer without unreasonable delay, and in any event within the time our agreement with that Customer requires. The Customer is responsible for any notices to its patients and to regulators, and we will provide the information it needs to give them.
• For account information and other information we control, we will notify affected individuals and regulators as required by applicable state and federal law.

10. How long we keep information

The Service does not yet delete records automatically on a schedule. Deletion is done by us, by hand, on request. How long each kind of information is kept today:

• Patient information: until the Customer asks us to delete it. Medical record retention periods are set by law and by the Customer, not by us. When our agreement with a Customer ends, the Customer can ask us to return or delete its information.
• Account information: while the account is active, and after it closes until it is deleted on request.
• Audit records: for as long as the law requires. The application has no function that deletes them.
• AI usage records: as long as the patient and practice records they refer to.
• Request logs: for our hosting provider’s standard log-retention period.
• Error reports: for our error-monitoring provider’s standard retention period.
• Voice dictation audio: not stored.
• Secure-link codes and links: codes sent to patient representatives expire after 10 minutes, and links after 72 hours.
• Information on your device: until you sign out on that device or clear your browser’s storage.

11. Your rights and choices

Patients and their representatives

Your medical practice controls your health information in the Service. To see, correct or get a copy of your records, or to ask how they have been shared, contact your practice. If you contact us, we will refer your request to your practice and help it respond.

Users of the Service

Wherever you live, you can ask us to tell you what personal information we hold about you, to give you a copy of it in a portable format, to correct it, or to delete it. Email contact@miltinson-technologies.com. Some account information is controlled by your practice, which can also update or deactivate your account.

We will verify your identity before we act on a request, respond within 45 days, and tell you if we need more time and why. We will not treat you differently for making a request.

Appeals

If we decline your request, you can appeal by replying to our decision or emailing contact@miltinson-technologies.com with the subject “Privacy appeal.” We will respond in writing within 45 days and explain our reasons. If we deny your appeal, you may contact the attorney general of your state.

Do Not Track and Global Privacy Control

We do not sell personal information, and we do not share it for cross-context behavioral advertising. There is nothing to opt out of, so we treat every visitor as opted out, including browsers that send a Global Privacy Control signal. We do not change how the Service works in response to Do Not Track signals, because it does not track visitors across other sites.

Cookies

We use only cookies that are strictly necessary to keep you signed in. We do not use advertising or analytics cookies. The other items stored on your device are listed in section 2.

12. Consumer Health Data Privacy Policy (Washington)

This section is our consumer health data privacy policy under Washington’s My Health My Data Act (chapter 19.373 RCW), and similar laws in other states.

Our role. Most health information in the Service would be protected health information that we handle for Customers under the federal HIPAA rules, or information about people acting in their jobs. Neither is “consumer health data” under the Act. Where the Act does apply to health information in the Service, we process it on behalf of the Customer that provided it, as that Customer’s processor, and only as the Customer instructs.

Consent

We collect no consumer health data today. The Service has not launched and holds only sample data.

At launch, health information will reach the Service only from Customers, which are health care providers, under a business associate agreement. That information is protected health information governed by HIPAA, not consumer health data under the Act. If we ever collect consumer health data that the Act covers, we will get the consumer’s consent before we collect it. Where we act as a Customer’s processor, the Customer is responsible for obtaining that consent. We will get separate consent before sharing consumer health data for any purpose other than providing the Service, and we will never sell it.

Categories of consumer health data we collect

None today. At launch, the patient information categories listed in section 2: identity and demographics, health conditions and diagnoses, visits and clinical notes, medications and prescriptions, care management and hospital events, remote monitoring readings, health documents, and voice dictation during care.

Why we collect and use it

Only to provide the Service to the Customer that supplied it, as described in section 3 and section 4. We do not sell consumer health data.

Where we get it

From the Customer and its staff, and from the systems the Customer connects: its electronic health record, fax service, facility event feed and monitoring devices.

Categories we share, and with whom

We share the categories above with the service providers listed in section 6, only as needed for the function each performs; with the Customer’s connected systems and the adult family homes and patient representatives the Customer directs us to deliver notes to; and as required by law.

How to exercise your rights

You have the right to confirm whether your consumer health data is collected, shared or sold, to access it, to learn who it has been shared with, to withdraw consent and to have it deleted. Because we would process this data for your medical practice, the fastest route is to ask your practice. You can also email contact@miltinson-technologies.com or call (425) 470-3556. We will respond within 45 days, or pass your request to your practice and help it respond. You may appeal a decision as described in section 11.

13. HIPAA

Our Customers are generally covered entities under HIPAA. When we create, receive, maintain or transmit protected health information for a Customer, we will do so as its business associate. We will not accept patient information from a Customer until we have signed a business associate agreement with it, and business associate agreements with the providers that would handle that information. None is signed today. Once signed, that agreement, not this policy, sets our HIPAA obligations to that Customer.

Each Customer remains responsible for its own HIPAA obligations, including its notice of privacy practices, patient authorizations, and how its staff use the Service. See our Terms of Use.

14. Children

The Service is for health care professionals and is not directed to children. Accounts are not available to anyone under 18, and we do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it. To tell us, email contact@miltinson-technologies.com. Patient information a Customer enters is handled for that Customer, as described in this policy.

15. Changes to this policy

We will post changes on this page and update the “Last updated” date at the top. If a change materially affects how we handle personal information, we will tell Customers by email before it takes effect.

16. Contact us

Questions or requests about this policy: