Patient Portal Privacy Policy

This is NOT a Notice of Privacy Practices (NPP). Your healthcare provider is the covered entity for your records and issues its own NPP under 45 CFR 164.520. This policy explains, in plain language, how Sefton — the company that operates the patient portal and telehealth as your provider's business associate — handles your information. For your full patient rights, see your provider's Notice of Privacy Practices.

Who this policy is for. This policy is for patients, and parents or guardians acting for a patient, who use the patient portal or a telehealth visit. Healthcare practices and website visitors are covered by Sefton's Privacy Policy (Providers, Practices and Website Visitors).

• Your provider is the covered entity. Your provider controls your records and decides how your PHI is used for your care. Direct questions about your records and your rights to your provider.
• Sefton operates the portal and telehealth as your provider's business associate. We process your information only to provide the service to your provider, under a Business Associate Agreement and HIPAA.

• Account data: the name, contact details, and login credentials you use for the portal.
• Health information (PHI): appointments, messages with your care team, documents your provider shares, intake information you enter, and — where you consent — telehealth recordings, transcripts, and notes.
• Technical data: device/app information, IP address, and diagnostics used to operate and secure the portal. We avoid putting PHI in analytics or non-PHI logs.
• How you use the portal: we record which parts of the portal you use and when — for example that you opened an appointment, completed an assigned exercise, read a message from your care team, or switched the portal to another language. We record this as counts and categories only. We do not record what your messages say, the names of your documents, or anything you type. We also do not record whether you use accessibility features such as a screen reader.

We use your information only to provide the portal and telehealth to you and your provider: to schedule and conduct visits, deliver messages and documents, support automated documentation (which your provider reviews), and secure the service. We do not sell your information, and we do not use it to train any artificial-intelligence or machine-learning model.

We use the record of how you use the portal for three things. First, so your care team can follow up with you — for example, if an intake form was left unfinished before your visit, or if you have not been able to join a video visit. Second, to improve the portal itself, such as fixing a step where many people get stuck. Third, in de-identified, combined form, for research into how to make care work better — for example, whether people who receive care in their own language have a different experience.

There are limits we hold ourselves to. This information is never used to deny, delay, or limit your care, and it is never used to score or rank patients. It is never sold, and never shared with an employer or an insurance company. Information about payments — such as viewing a bill or asking about a payment plan — is used only in combined form and is not shown to your clinician as a judgement about you. Whether you read your own visit notes is likewise only ever used in combined form.

If you would rather your information not be included in research, tell your provider and we will exclude it. This does not affect your care, and your care team can still see what they need to support you.

Your provider's practice may contribute de-identified, combined figures (such as how often a billing code is used) to benchmarks that help practices compare themselves. These figures never identify you, are never sold, and are never used to train AI models. Your information is excluded from research if you ask your provider, as described in Section 3.

Where your provider offers telehealth, your session may be recorded, transcribed, and processed by automated documentation tools, and real-time translation may be provided — only as described in and consented to under the Telehealth Recording, Transcription & Automated Documentation Consent. You can decline recording and still receive care where clinically appropriate, and you can withdraw consent for future sessions. If you speak a language other than English, you have the right to a qualified human interpreter provided by your provider at no cost to you; machine translation is offered only as an additional convenience and is never a substitute for one. Section 5 names the services that do this processing, and Section 6 says how long recordings and transcripts are kept.

Sefton uses a small number of other companies to run the portal and telehealth. Each one that handles your health information does so under a business associate agreement that requires it to protect that information as HIPAA requires.

• Amazon Web Services (AWS) hosts the portal and stores your information.
• Amazon Transcribe, an AWS service, turns speech into text, for example the live captions in a telehealth visit and the transcript of a recorded visit.
• Amazon Translate, an AWS service, translates text when you and your care team use different languages, for example messages from your care team, visit captions, home programs, intake forms, goals and appointment reminders. Portal content is translated automatically when your portal language differs from the language it was written in.
• Amazon Polly, an AWS service, reads translated captions aloud in a video visit when your provider turns on spoken translation. What it receives is the translated text of what you said.
• Amazon Bedrock, an AWS service that runs artificial-intelligence models, helps your provider draft visit notes from a visit transcript or the provider's dictation, suggest billing codes, and write letters to your insurance company about a denied claim. What it receives can include your name, date of birth, diagnoses, treatment goals, visit details and what was said in a visit. Your provider reviews every draft.
• Sefton sends this information only to AWS. It is used only to provide the feature to you and your provider, and we do not use it to train artificial-intelligence models (Section 3).
• Claim.MD sends your provider's insurance claims to your insurer and returns the insurer's response.
• If you pay a bill in the portal, you enter your card details on the payment page of our payment processor, Stripe. Stripe receives the payment details you enter and an internal reference to your bill; it does not receive your visit notes or diagnoses. Sefton does not store your card number.

The current list of companies that handle health information is at sefton.health/trust.

• Your health records, such as visit notes, documents, messages, forms, appointments and billing records, are part of your provider's medical record. Sefton keeps them for your provider while your provider uses Sefton and does not delete them on a schedule. Our standard is to keep them for at least seven years. When your provider stops using Sefton, your provider can export its records, and Sefton then returns or destroys them as its agreement with your provider requires.
• Telehealth recordings. A recording kept only to help your provider write the visit note is deleted 30 days after the note is signed, or 30 days after the visit if no note is signed. If your provider makes a recording part of your medical record, it is kept for at least ten years after your last visit or discharge and, if you are a minor, at least until you turn 28, whichever is later. Your provider may choose to keep recordings longer. Some recordings made before October 2026 keep the deletion date they were given when they were made, which can be up to seven years.
• Visit transcripts may be deleted on the same schedule as the visit's recordings. The transcript of a visit with a recording that is part of your medical record is kept with that recording.
• Information under a legal hold is kept until the hold is released.
• Records of who viewed or changed your information are kept for seven years, for security and HIPAA purposes.
• Backup copies of our database are deleted after 35 days.

• Your HIPAA rights (to access, amend, restrict, receive an accounting of certain disclosures, and request confidential communications) are exercised through your provider, who is the covered entity. We support your provider in fulfilling them.
• Telehealth consent. You can give or withdraw consent for recording and transcription, automated documentation support, and real-time translation at any time in Settings, under Telehealth consent (in the iOS app, Settings is under More). Withdrawing consent applies to future visits. When you withdraw consent to recording, a recording kept only to help write a visit note is deleted; a recording that is already part of your medical record is kept, but it is no longer played back or sent to AI services.
• Permission for AI services in the app. Where the app asks your permission before sending your voice or text to the AI services in Section 5, you can withdraw that permission at any time in Settings. Withdrawing it stops future sending; it does not undo processing already done.
• Text messages. You can turn text message reminders on or off in Settings, under Notifications, or reply STOP to any text.
• Research. To be left out of research, tell your provider (Section 3).
• You may contact us at privacy@sefton.health with questions about how the portal handles your information; for questions about your care or records, contact your provider.

You can delete your portal account yourself. In the portal or the iOS app, open Settings and choose Delete account (in the iOS app, Settings is under More), then confirm. Your portal sign-in is closed right away, you are signed out, and Sefton receives a request to delete the account, which we complete under the retention rules in Section 6. You can also ask us to delete your portal account by writing to privacy@sefton.health.

Deleting your portal account does not delete your health records. They are part of your provider's medical record, which your provider must keep under medical-record law. For questions about those records, contact your provider.

We protect your information with administrative, physical, and technical safeguards, including encryption in transit and at rest, access controls, multi-factor and passkey sign-in options, and audit logging. No system is perfectly secure, but we work to protect your information and to respond to incidents.

The portal is used at the direction of your provider. Information about pediatric patients is handled as PHI under your provider's direction and HIPAA, not as consumer data collected directly from children.

We may update this policy; material changes will be communicated by reasonable means. Questions: privacy@sefton.health. For your rights and your records, contact your provider. If you believe your privacy rights have been violated, you may file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (www.hhs.gov/ocr/privacy/); we will not retaliate against you for filing a complaint.