Project Skylar Privacy Policy

1. Who we are and what this policy covers

912 Dynamics, Inc. is a Delaware corporation located at 325 Martha Lane, Fort Worth, TX 76126. This policy describes our handling of information in Project Skylar’s web application and supported mobile applications. Contact support@912dynamics.com for privacy, security, support or records requests.

When we process protected health information (PHI) for a Customer organization as its business associate or subcontractor, the Customer’s agreement, Business Associate Agreement (BAA) and applicable law govern that processing. This policy does not replace the Customer’s Notice of Privacy Practices, create a BAA, or authorize PHI in an unapproved feature. The Customer is generally responsible for decisions about its records and for responding to individuals’ HIPAA rights requests.

The marketing website has a separate privacy notice at /privacy. Its marketing, public-submission, aggregate-information and business-transfer language does not expand the permitted uses of confidential Customer records or PHI. A BAA controls any conflict about PHI.

2. Information the service may process

Depending on the Customer’s enabled features and permitted data scope, Project Skylar may process account and contact details, department and role assignments, authentication and security metadata, protocol and reference documents, submitted text, voice inputs and generated transcripts, AI responses and conversation history, CPR timing and events, private staff messages, and related service records.

Conversation history can contain submitted information and transcripts. A transcript retained within a conversation is part of that record even when there is no separate transcript archive. Which data may be submitted is determined by the Customer’s approved feature and environment scope, not simply by whether a field is available.

Technical information may include IP addresses, device and browser information, timestamps, session and access events, diagnostic information and service usage. Users should avoid including unnecessary patient information in free text, filenames, feedback, diagnostics or support requests. Location-enabled functions may process precise coordinates, not only a general area.

3. Purposes and limits on use

We process information to operate the contracted service, authenticate users, enforce department permissions, provide enabled workflows, maintain security, investigate service problems, support authorized requests and comply with applicable legal obligations. Access to Customer records is limited to authorized purposes.

PHI is used or disclosed only as permitted or required by the applicable BAA or law. General website terms do not authorize selling PHI, using it for advertising or general-purpose model training, or treating it as public content. Any de-identification, aggregation or additional use must satisfy the BAA and applicable law; removing direct identifiers alone does not establish that data is de-identified.

4. Approved healthcare-data scope

PHI may be introduced only after the required agreement is executed and 912 Dynamics and the Customer confirm the approved Production environment, features, data destinations and required safeguards. Development, testing, demonstration and trial workflows use synthetic or otherwise expressly permitted data. Signing in, acknowledging a disclaimer or enabling MFA does not alone authorize PHI processing.

The Customer’s authorized administrator can request the current service-provider and feature schedule from support@912dynamics.com. Optional integrations are not automatically eligible for PHI. Data subject to additional legal restrictions requires review before use.

5. Service providers and disclosures

Project Skylar’s approved healthcare-data configuration uses Google Cloud services within the agreed scope. Protocol search uses Typesense software privately operated by 912 Dynamics on Google Cloud; Typesense Cloud is not the active protocol-search host. Approved OpenAI API features may process information under the applicable agreements and configured retention controls. This description does not authorize every Google, OpenAI or other vendor feature for PHI.

Providers’ storage, safety processing, application state and backup behavior depend on the selected feature and applicable terms and controls. We do not describe an Eyes Off setting as zero retention or promise that all provider processing is transient. The approved schedule and actual configuration govern the Customer’s use.

Providers and subcontractors handling PHI on our behalf must be subject to the required agreements, restrictions and safeguards. Other disclosures occur only as permitted or required by the BAA and law. A business reorganization or change of ownership does not independently authorize broader PHI use or disclosure; applicable protections and contractual duties continue.

6. Marketing, support and location boundaries

Customer PHI must not be entered into marketing contact forms, ordinary email, advertising analytics, CRM submissions, push-notification bodies or unapproved vendor and support channels. Contact support@912dynamics.com with a general description first so an appropriate secure channel can be arranged. Do not send a password, MFA secret or recovery code.

Location associated with a patient or incident can be sensitive healthcare information. A routing or mapping feature is eligible for that data only when its workflow and destination have been specifically approved. Device location permission alone is not that approval.

Optional analytics on the public marketing website is separate from application conversation analytics. Website analytics follows the consent controls and disclosures in the website privacy notice; it is not authorized to receive Customer PHI. Service and security communications are separate from optional promotional communications.

7. Device storage and offline use

Browsers and supported mobile applications can store authentication state, session data, caches and permitted offline reference documents. A WebView wrapper does not eliminate local storage. Local data and offline availability depend on the client version, enabled features and applicable policy.

Use a supported, patched device, screen lock and required authentication controls. Protect downloaded references and follow the Customer’s device and logout procedures. Report a lost device or suspected unauthorized access promptly to the Customer’s administrator and support@912dynamics.com.

8. Retention and authorized disposition

Our default is to retain authoritative Customer records until an authorized explicit disposition request, subject to applicable law, legal holds and the Customer’s agreement. Records are not automatically deleted solely because of their age, account inactivity or subscription cancellation. Continued custody remains subject to the applicable service arrangements, confidentiality and BAA protections.

Formal BAA termination follows the applicable return-or-destruction requirements where feasible. If return or destruction is infeasible, the reason and retained records must be documented, protections continue, and further uses and disclosures are limited accordingly. A preference for indefinite storage does not itself establish infeasibility.

Temporary processing files, authentication and device caches, security logs and backup versions have separate operational lifecycles. A verified disposition request is assessed for authority, scope, holds, provider copies and backups. The outcome record identifies remaining lawful copies and completion or backup-expiry timing, including handling if a backup is restored. Deletion is not necessarily immediate across every copy. Applicable records laws and agreements, rather than a universal HIPAA six-year minimum for all records, determine any required retention.

9. Your requests and choices

For access to or correction of medical records, individuals should ordinarily contact the Customer organization responsible for their care or records. We coordinate requests we receive directly with that Customer and assist with applicable access, amendment and accounting obligations under the BAA and law. This policy does not limit an individual’s applicable legal rights.

For account privacy questions or an authorized Customer records request, contact support@912dynamics.com without including patient information in the initial email. We verify identity and authority through an appropriate process, not by asking you to email credentials. A deletion request may be completed through a documented manual process. Legal requirements, holds and the Customer’s authority can affect whether and when a request can be fulfilled.

10. Safeguards and incidents

We apply the administrative, physical and technical safeguards required by applicable law and the BAA to PHI within the approved service. These duties include authorized access and incident handling; no service can promise absolute security. Customer device practices, appropriate permissions and compliance with required authentication controls are also important.

We report security incidents and impermissible uses or disclosures as required by the BAA and law, including breach notification without unreasonable delay and within applicable deadlines. Report concerns to support@912dynamics.com using a general description until a secure exchange is arranged.

11. Children and professional users

Project Skylar is intended for authorized professional and organizational users, not for children under 13 to create accounts or use independently. This does not prohibit an authorized professional from handling a minor patient’s information within an approved workflow and the applicable legal authority.

12. Changes and contact

We publish a version and effective date and communicate material changes through the applicable Customer notice process. A revised public policy does not amend a signed BAA or retroactively authorize new uses of PHI. Executed agreements remain subject to their amendment and acceptance requirements.

Privacy, security, support and records contact: support@912dynamics.com. Postal address: 912 Dynamics, Inc., 325 Martha Lane, Fort Worth, TX 76126.