Privacy

This Privacy Policy explains how Salisan, Inc. ("Salisan", "we", "us") collects, uses and shares personal information when you visit our US website, contact us or use Salisan in the United States.

Scope

This policy covers personal information that Salisan handles for its own purposes. Healthcare practices use Salisan to keep patient records and to communicate with patients. For that information, the practice is responsible, and Salisan acts as its business associate under a Business Associate Agreement. The practice's notice of privacy practices applies. If you are a patient, please contact your practice; if you contact us, we will forward your request to it.

Information we collect and how we use it

Website visits

• Information: IP address, browser type, pages visited and time of visit.
• Purpose: to operate and secure the website.
• Retention: server logs are kept for 30 days, and deleted copies are removed within a further 30 days.

Sales and demo requests

• Information: name, email address, organization and its size, your message and, if you book a demo, the time you choose. Messages from our contact form reach our team by email. We use Cal.com to schedule demos.
• Purpose: to answer your request, arrange a demo and follow up on it.
• Retention: while we are in contact with you, and up to 24 months after our last contact, unless your organization becomes a customer.

Business contacts we reach out to

• Information: your name, role, practice, work email address and work phone number, and professional information you or your practice have made public, such as on the practice website. We also note our contacts with you, such as messages, meetings and whether you want to hear from us.
• Sources: your practice's website, public professional directories and registers, professional networks such as LinkedIn, events where we meet, and introductions from people who know you.
• Purpose: to introduce Salisan to healthcare practices that may benefit from it and to keep track of those conversations. To prepare, we may use AI tools to search and summarize public information about your practice. We do not use these tools to make decisions about you.
• Retention: while we are in contact with you, and up to 12 months after our last contact, unless your organization becomes a customer. If you ask us not to contact you, we keep only your name and email address on a do-not-contact list, so that we respect your request.

Waitlist

• Information: email address and the page where you signed up.
• Purpose: to tell you when Salisan is available to you. You can unsubscribe at any time.
• Retention: 12 months.

Accounts

• Information: name, email address, password, profile picture, language, role, security settings and sign-in history (IP address and device). We may receive these details from your practice when it invites you, from Google if you sign in with Google, or from your organization's single sign-on provider.
• Purpose: to create and secure your account and to provide the service your organization has subscribed to.
• Retention: for as long as your account exists; sign-in alerts are kept for 90 days. After your account is deleted, your name may remain in a practice's records where they must show who made an entry, and in our record of contract acceptance.

Use of the service

• Information: technical and usage data, such as server logs, error reports, performance data and records of AI usage (not the content).
• Purpose: to operate, secure, bill and improve the service.
• Retention: logs, error reports and performance data for 30 days; AI usage records with our billing records.

AI features

When you use the Agent or other AI features, we send your request, relevant conversation history and information retrieved by authorized tools to our AI provider, Fireworks, to produce a response. Depending on the feature, this can include patient names and clinical content, which we process on the practice's behalf under our Business Associate Agreement.

Fireworks processes this content under a business associate agreement with us. We do not use customer content to train AI models, and our agreements with our AI providers do not allow them to do so. AI requests run with zero data retention: Fireworks does not keep the content of requests or responses after processing. Consultation recordings are transcribed by Amazon Transcribe in our US hosting environment. For literature and web research, we send only the search question, after checking it for names and other identifiers.

We reduce identifying information supplied by patient tools, for example by providing age instead of an exact birth date and contact availability instead of contact details. Text filters redact supported patterns for sensitive identifiers, payment details and credentials before model requests. A clinician reviews every AI draft before it is used.

AI-use restrictions. Do not provide AI features with government or health-insurance identifiers, payment-card or bank-account details, passwords or access credentials, or information about anyone under 13. Practices choose in Settings whether AI features may be used for patients aged 13 to 17; while that setting is off, patients under 18 are excluded from AI automatically, based on their recorded date of birth. These restrictions cover chat, pasted text, attachments, images and recordings; see section 7.6 of our Terms of Service.

Billing

• Information: organization name, billing contact name and email address, billing address, tax identifier, and subscription and payment status. Stripe processes card and bank details; we do not receive full card numbers.
• Purpose: to charge for the service and to keep invoices and billing records for our tax and accounting duties.
• Retention: invoices and billing records for 7 years; other payment records for 90 days.

Support

• Information: your messages to us through our contact form, by email or to the support assistant, your name, email address and organization, and the page you were on. Please do not include patient details in these messages.
• Purpose: to respond to your request and improve our help. We may turn resolved requests into help articles after removing personal and patient information.
• Retention: support assistant conversations for 90 days; support requests for 2 years after they are closed.

Contracts

• Information: who accepted which version of our terms, for which organization and when, and correspondence about the contract.
• Purpose: to evidence our contracts and to establish or defend legal claims.
• Retention: for the duration of the contract and 5 years after it ends.

Cookies

Our website uses only cookies and similar storage that are strictly necessary for it to work, such as your language and privacy choices. If we measure how the website is used, we do so only with your consent, using cookie-free analytics that we host ourselves. They do not store your IP address and count visits with an identifier that changes daily. Analytics data is kept for 13 months and your choice for 3 years. See our cookie and analytics notice for details.

Do Not Track and Global Privacy Control. We do not track you across other websites. If your browser sends a Do Not Track or Global Privacy Control signal, we do not measure your visit, even if you have accepted analytics.

How we share personal information

We do not sell personal information, share it for targeted advertising, or disclose it to third parties for their own marketing. We share it only as described below.

Service providers. We use the following providers to run Salisan in the United States. They process personal information on our behalf, under contract and on our instructions.

The providers that receive patient information are listed on our subcontractor page.

Your organization. If you are a member of a practice, its administrators can see your name, email address, role and activity in their workspace.

Other recipients. Stripe also processes payment data on its own account, for example to prevent fraud. If you sign in with Google or your organization's single sign-on, that provider processes the sign-in under its own privacy policy.

Legal reasons and business transfers. We may disclose personal information where the law requires it, to protect our rights or the safety of others, or to a successor if our business is sold or reorganized. We disclose information that we hold for practices only as our Business Associate Agreement permits.

Retention

We keep personal information only for as long as needed for the purposes described in this policy, or longer where the law requires it. The periods for each purpose are listed above. Backups are kept for 35 days.

Security

We use administrative, technical and physical safeguards appropriate to the risk, including encryption in transit and at rest, role-based access, two-factor authentication and audit logging. If a security breach affects your personal information, we will notify you as the law requires.

Your choices and requests

Wherever you live in the United States, you can ask us to access, correct or delete your personal information, and to stop contacting you about Salisan, by writing to privacy@salisan.com. We respond within 45 days and may ask you to verify your identity. We will not treat you differently for making a request.

Children

Salisan is a service for healthcare professionals and organizations, not for children to use directly. Practices keep records about patients of all ages. AI features are never used for patients under 13, and are used for patients aged 13 to 17 only when the practice has chosen this in Settings.

Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new date and, if the changes are significant, notify account holders by email or in the app before they take effect.

Contact us

Salisan, Inc., 2261 Market Street STE 38901, San Francisco, CA 94114, United States

Email: privacy@salisan.com