Privacy Policy

1. Who This Policy Covers

This Privacy Policy applies to licensed healthcare professionals and other authorized users ("Users," "you") who register for and use the ClarityTX platform. ClarityTX is a clinician-facing service. When a practice submits patient information, we process it on the practice’s behalf under the applicable BAA. Patients should contact their treating practice about their records.

HIPAA and patient information: ClarityTX is a HIPAA-compliant clinical decision support platform, and a practice Business Associate Agreement ("BAA") is available. Authorized patient information may be processed through the designated clinical features under the applicable BAA. See Section 8 of our Terms of Use for practice responsibilities and how to arrange a BAA.

2. Information We Collect

2.1 Information You Provide Directly

• Account and Profile: Your email address when you create your account, and profile information provided by your sign-in provider. First and last name are requested before paid checkout if missing. You may add or update your name, professional title, and optional practice information in Settings;
• Payment Information: Billing details (credit card number, billing address) provided when you subscribe. Note: payment card data is transmitted directly to Stripe, Inc. and is never stored on Tulip Health's servers;
• Clinical Information: Questions, conversation history, patient details, diagnoses, lab results, treatment histories, uploaded records, and other clinical context that authorized users submit through clinical features. This may include PHI processed on behalf of a practice under its applicable BAA;
• Correspondence: Emails, support tickets, or other communications you send to us.

2.2 Information Collected Automatically

When you access the Services, we and our service providers may automatically collect:

• Usage Data: Pages viewed, features accessed, search queries (non-PHI), session duration, clicks, and navigation paths within the platform;
• Device and Browser Information: IP address, browser type and version, operating system, device type, screen resolution, and language settings;
• Session Identifiers: Unique session tokens and authentication tokens used to maintain your logged-in state;
• Cookies and Similar Technologies: See Section 5 below for details.

2.3 Information to Keep Out of Clinical Requests

Do not submit information you are not authorized to share or that is unnecessary for the clinical task, including:

• Social Security numbers, financial account details, or unrelated personal identifiers;
• Patient information outside your authorization or the scope of the applicable BAA;
• Credit card numbers (processed directly by Stripe, not retained by us);
• Biometric identifiers that are not needed for the clinical task.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Providing the Services: Processing your questions through our AI systems, saving your generated treatment plans and preferences in your account, and enabling all platform features;
• Account Management: Creating and maintaining your account, authenticating your identity, and communicating with you about your account;
• Billing and Payments: Processing subscription payments through Stripe, managing renewals and cancellations, and resolving billing disputes;
• Platform Improvement: Analyzing anonymized, aggregated usage patterns to improve features, fix bugs, and develop new functionality. We do not use your questions to train third-party AI models without your consent;
• Security and Fraud Prevention: Detecting, investigating, and preventing unauthorized access, abuse, or fraudulent activity;
• Communications: Sending transactional emails (receipts, security alerts, account notifications), product update announcements, and where you have consented, marketing communications;
• Legal Compliance: Complying with applicable laws, regulations, legal process, and enforceable governmental requests.

4. Data Storage, Infrastructure, and Sub-Processors

Your data is processed and stored using the following third-party infrastructure providers (collectively, "Sub-Processors"):

• Google Firebase / Google Cloud (Google LLC): We use Firebase for user authentication, cloud-hosted NoSQL database storage (Firestore), file storage (Firebase Storage), and application hosting. Your account information, saved treatment plans, and session data are stored in Firebase infrastructure hosted in Google's U.S. data centers. Google's data processing is governed by Google's Cloud Data Processing Addendum and Privacy Policy;
• Stripe, Inc.: Payment processing and subscription management. When you enter payment information, it is transmitted directly to Stripe's servers via encrypted connection. Tulip Health does not receive or store your full payment card number. Stripe's privacy practices are governed by Stripe's Privacy Policy;
• OpenAI: ClarityTX's clinical conversation service uses OpenAI to generate answers. Questions, conversation history and clinical context included in a request are processed through ClarityTX's backend and OpenAI. Include only information authorized for the clinical task. Submitting information does not automatically anonymize it. Processing of PHI must be within the scope of the applicable BAA and service agreements. Native apps request AI-processing permission before opening clinical tools; you can withdraw that permission in Settings.
• Google Analytics (Google LLC): We use Google Analytics to collect anonymized, aggregated data about how users interact with the platform (pages visited, features used, session lengths). This data is used solely for product improvement. Google Analytics data is governed by Google's privacy policies. You may opt out of Google Analytics tracking by using the Google Analytics Opt-Out Browser Add-on.

We enter into data processing agreements with our Sub-Processors where required by law and select providers that maintain industry-standard security practices. For PHI, permitted uses and disclosures, subcontractor obligations, retention, return or deletion, and incident notification are governed by the applicable BAA and law. This Privacy Policy does not expand those permissions.

5. Cookies and Similar Tracking Technologies

We use cookies and similar tracking technologies (such as local storage and session tokens) to operate and improve the Services. Types of cookies we use:

• Strictly Necessary Cookies: Required for authentication, security, and core platform functionality. These cannot be disabled without impairing service use;
• Analytics Cookies: Set by Google Analytics to collect anonymized usage data. You may opt out via the Google Analytics Opt-Out Add-on;
• Preference Cookies: Used to remember your settings and preferences within the platform (e.g., saved view states).

Most browsers allow you to refuse or delete cookies. Disabling strictly necessary cookies may prevent you from using the Services. We honor "Do Not Track" signals to the extent required by applicable law.

6. How We Share Your Information

We do not sell your personal information. We share information only as follows:

• Sub-Processors: As described in Section 4, we share necessary data with Firebase, Stripe, OpenAI, and Google Analytics solely to operate and improve the Services;
• Legal Requirements: We may disclose your information if required by law, subpoena, court order, or government request, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Tulip Health, our users, or the public;
• Business Transactions: In the event of a merger, acquisition, financing, or sale of all or part of our business, your information may be transferred to the acquiring entity. We will notify you of any such change and ensure that your data continues to be governed by a privacy policy at least as protective as this one;
• Consent: We may share your information with third parties when you have given us explicit consent to do so.

7. Data Retention

We retain your personal information for as long as your account is active and for a reasonable period thereafter to fulfill our legal, contractual, and business obligations. Specifically:

• Account and profile data is retained for the duration of your account and deleted within 90 days of a verified account deletion request;
• Saved treatment plan data (stored in Firestore) is retained while your account is active and deleted upon account deletion;
• Billing records are retained for a minimum of seven (7) years as required for financial compliance;
• Usage and analytics data (Google Analytics) is retained in accordance with Google's retention policies, typically 26 months;
• Support and correspondence data is retained for up to three (3) years after the last communication.

To request deletion of your data, contact us at info@meetclaritytx.com or use your account settings. We will respond within 30 days and complete deletion as soon as reasonably practicable, subject to our legal retention obligations.

8. Security

We implement industry-standard security measures to protect your information, including:

• TLS/SSL encryption for all data in transit;
• Firebase Security Rules to enforce access controls at the database level;
• Firebase Authentication for secure identity management;
• Payment data handled entirely by Stripe's PCI DSS-compliant infrastructure;
• Role-based access controls limiting employee access to user data.

Despite these measures, no security system is impenetrable. We cannot guarantee the absolute security of your data. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you as required by applicable law, typically within 72 hours of becoming aware of the breach (for GDPR) or as otherwise required by applicable U.S. state law.

9. Your Rights and Choices

Subject to applicable law, you have the following rights with respect to your personal information:

• Access: Request a copy of the personal information we hold about you;
• Correction: Request correction of inaccurate or incomplete data;
• Deletion: Request deletion of your personal information, subject to our legal retention obligations;
• Portability: Request a machine-readable export of your data (available to EEA/UK residents under GDPR);
• Objection / Restriction: Object to or request restriction of certain processing activities;
• Marketing Opt-Out: Unsubscribe from promotional emails at any time using the link in any such email or by contacting us directly. Transactional and account-related communications are not affected;
• Cookie Preferences: Manage cookies through your browser settings or the Google Analytics opt-out tool.

To exercise any of these rights, contact us at info@meetclaritytx.com. We will respond within 30 days (or as required by applicable law). We will not discriminate against you for exercising any privacy rights.

10. GDPR: EEA and UK Residents

If you are located in the European Economic Area (EEA) or the United Kingdom, the following additional terms apply.

Legal Basis for Processing. We process your personal data only where we have a lawful basis to do so:

• Contract: Processing necessary to provide the Services you have subscribed to;
• Legitimate Interests: Processing for fraud prevention, security, product improvement, and direct marketing (where not overridden by your interests);
• Legal Obligation: Processing required by applicable law (e.g., financial records retention);
• Consent: Where you have given explicit consent (e.g., marketing emails).

International Transfers. Your data is processed in the United States. Transfers from the EEA/UK to the U.S. are made pursuant to applicable transfer mechanisms, including Standard Contractual Clauses where required.

Right to Complain. If you believe we have processed your data in violation of applicable law, you have the right to lodge a complaint with your local data protection authority.

11. CCPA: California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the business or commercial purposes for collection, and the categories of third parties with whom we have shared your information;
• Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions;
• Right to Correct: Request correction of inaccurate personal information;
• Right to Opt Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising as defined under the CCPA;
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise your California privacy rights, contact us at info@meetclaritytx.com. We will verify your identity before processing your request.

12. Children's Privacy

The Services are intended solely for licensed healthcare professionals who are at least 18 years of age. We do not knowingly collect personal information from any person under the age of 18. If we become aware that we have inadvertently collected personal information from a minor, we will promptly delete it.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you by email. We encourage you to review this Policy periodically. Your continued use of the Services following the posting of changes constitutes your acceptance of the updated Policy.

14. Contact Us

For questions, requests, or concerns regarding this Privacy Policy or our data practices, please contact our Privacy Team:

Tulip Health Inc.
13809 Research Boulevard
Austin, Texas 78750
Email: info@meetclaritytx.com

EEA/UK residents with GDPR inquiries may contact us at the above address. We aim to respond to all privacy requests within 30 days.