Privacy Policy

Effective Date: January 1, 2026  |  Last Updated: October 28, 2026

SIVIA Medical (the "Platform"), operated by SisaTech AI, Inc. ("we," "us," or "our"), provides AI-powered clinical documentation and ambient assistant services for healthcare providers. We are committed to protecting the privacy and security of all information processed through our Platform.

This Privacy Policy explains how we collect, use, disclose, and safeguard information when healthcare providers, clinical staff, and authorized administrators ("Users") access or use our Platform, including our website at sisatech.ai, the application at app.siviamedical.com, our mobile applications, and our integrations with Electronic Health Record ("EHR") systems such as PointClickCare, eClinicalWorks, and Veradigm.

1. HIPAA Compliance and Protected Health Information (PHI)

Our Platform is designed for use by healthcare providers who are "Covered Entities" under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). In our capacity as a service provider to Covered Entities, we act as a "Business Associate."

Term	Definition	SIVIA's Role
Covered Entity	Healthcare providers, health plans, and healthcare clearinghouses that transmit health information electronically.	Our Customers (Healthcare Providers)
Business Associate	An entity that performs functions or activities on behalf of a Covered Entity that involve the use or disclosure of PHI.	SIVIA Medical (SisaTech AI, Inc.)
Protected Health Information (PHI)	Individually identifiable health information transmitted or maintained in any form or medium.	Patient clinical data processed by SIVIA

We enter into a Business Associate Agreement (BAA) with each of our Covered Entity customers before processing any Protected Health Information ("PHI"). Any PHI we collect, receive, maintain, or transmit on behalf of a Covered Entity is governed strictly by the terms of the applicable BAA and HIPAA regulations.

2. Information We Collect

A. Provider and User Account Information

We collect personal information when you register for an account, subscribe to our services, or communicate with us. This may include:

• Name, professional title, and clinical specialty.
• National Provider Identifier (NPI) number.
• Email address, phone number, and physical practice address.
• Account credentials (usernames, passwords, and API keys).

B. Patient Information and Clinical Data (PHI)

To perform our core clinical documentation services, our Platform processes patient data. This information is typically retrieved via authorized EHR integrations (e.g., FHIR APIs) or entered directly by the clinical user:

• Patient demographics (name, date of birth, gender, medical record number).
• Clinical history (diagnoses, conditions, allergies, medications, lab results, vital signs).
• Audio recordings or transcripts of clinical encounters (captured with explicit patient consent).
• Generated clinical notes (SOAP notes, consultation letters, clinical summaries).

C. Technical and Usage Data

We automatically collect certain technical information when you access the Platform:

• Device information (browser type, operating system, device identifiers).
• Log data (IP address, access times, pages viewed, features used).
• Session cookies used solely to maintain session state and secure authentication.

We do not use advertising or tracking cookies. We do not share technical data with third-party advertisers.

3. How We Use Your Information

Purpose	Data Used	Legal Basis
Provide clinical documentation services	PHI, audio recordings, clinical context	BAA / Treatment operations
Maintain and secure the Platform	Technical data, access logs	Legitimate interest / Security
Provide customer support	Account information, usage data	Contractual obligation
Improve our product and services	De-identified, aggregated usage patterns	Legitimate interest

We do not use patient PHI to train our public or shared AI models. Any model optimization is performed using strictly de-identified data in compliance with the HIPAA Safe Harbor method or within secure, tenant-isolated private environments.

4. How We Share Your Information

We do not sell, rent, or trade your personal information or patient PHI to any third party. We only share information in the following circumstances:

• With Authorized EHR Systems: When you direct us to push clinical documentation or retrieve patient data from your connected EHR (e.g., PointClickCare, eClinicalWorks, Veradigm).
• With HIPAA-Compliant Service Providers (Subprocessors): Infrastructure and AI model providers that process data solely on our behalf under their own Business Associate Agreements with us: Google Cloud Platform (hosting, storage, and Vertex AI / Gemini models) and Anthropic, PBC (Claude models). Neither provider uses PHI processed for SIVIA Medical to train or improve its models. Transactional email (account verification, invitations, security notices) is delivered through a transactional email provider and never contains PHI.
• As Required by Law: When disclosure is required by a valid court order, subpoena, or applicable law.

5. Data Security and HIPAA Safeguards

We implement enterprise-grade administrative, physical, and technical safeguards as required by the HIPAA Security Rule:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
• Encryption at Rest: All stored data, including PHI, is encrypted using AES-256 encryption.
• Access Controls: Role-based access controls (RBAC) with principle of least privilege.
• Multi-Factor Authentication: Required for all administrative and clinical access.
• Audit Logging: Comprehensive, immutable audit trails for all PHI access and modifications.
• Infrastructure: Hosted on SOC 2 Type II certified Google Cloud Platform infrastructure within the United States.

6. Your Rights and Choices

A. Healthcare Providers (Users)

You can update your account profile, change your password, or modify your EHR integration settings at any time through the Platform settings panel. You may request account deletion by contacting us at support@sisatech.ai.

B. Patients

SIVIA Medical does not have a direct relationship with the patients whose information we process. If you are a patient and wish to exercise your HIPAA rights (such as the right to access, amend, or restrict disclosure of your medical records), please contact your healthcare provider directly. SIVIA Medical will assist your provider in responding to such requests in accordance with our BAA.

7. Data Retention

We retain Customer Data and PHI only for as long as necessary to provide the Services or as required by applicable law. Upon termination of a customer's subscription, we will delete or destroy all PHI in our possession in accordance with the terms of the BAA, typically within thirty (30) days unless a longer retention period is required by law or requested by the customer.

8. International Data Transfers

The Platform is intended solely for use within the United States. All data is processed and stored exclusively on servers located within the United States. We do not transfer PHI outside of the United States.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. If we make material changes, we will notify you by email or by posting a prominent notice within the Platform at least thirty (30) days before the changes take effect.

10. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our data protection practices, please contact us:

SisaTech AI, Inc.
Email: support@sisatech.ai
Address: Miami, FL, USA