Sana Crest handles sensitive health information on behalf of clinics. This policy describes our approach in plain language; the counsel-reviewed version will govern once finalized.
Scope of this policy
This policy explains how Sana Crest handles information across the marketing site and the platform. For Protected Health Information (PHI) processed on a clinic’s behalf, Sana Crest acts as a Business Associate; the clinic is the Covered Entity, and the Business Associate Agreement (BAA) governs that relationship.
Information we collect
We collect account and contact details from clinic staff, usage and device data needed to operate the platform, and the clinical and patient data your clinic enters to deliver care. On the marketing site we collect only what a visitor submits (for example, a demo request) plus standard, privacy-respecting analytics.
Protected Health Information and HIPAA
PHI is processed solely to provide the service and strictly per the BAA. We do not sell PHI, and we do not use it for advertising. Access to PHI is limited to the clinic’s own tenant through enforced tenant isolation, and to the minimum Sana Crest personnel necessary to operate and support the platform.
How we use information
We use information to provide, secure, and improve the platform; to communicate with clinic administrators; to meet legal and compliance obligations; and to deliver the features your clinic configures. We do not use patient data to train external models.
Sharing and sub-processors
We share information only with sub-processors that support the service — for example, hosting, database, email delivery, and payment processing — each under a contract with appropriate safeguards, and a BAA where PHI is involved. We do not share patient data with third parties for their own purposes.
Data retention
We retain clinical data for as long as your clinic maintains its account and as required by applicable healthcare-records law. On termination, data is available for export for a defined window before secure deletion, consistent with the BAA.
Your rights
Patients exercise their privacy rights — including access, correction, and deletion — through their clinic, which directs Sana Crest as its Business Associate. The platform includes tooling to support data export and right-to-delete requests.
Changes to this policy
We will update this policy as the platform and our practices evolve, and will notify clinic administrators of material changes. The counsel-reviewed version will replace this placeholder before the pilot.
Questions about this document? Email legal@sanacrest.com.