This Master Privacy Policy (“Policy”) describes how ClarityACP LLC (“ClarityACP,” “we,” “our,” or “us”) collects, uses, discloses, and retains information through our website (clarityacp.com), the Directive advance-directive tool, our telehealth platform (Casenote), our clinical quality framework (Lighthouse), our clinician talent portal (CompanionMap), our vetting tool (Scout AI), our browser extension, and related services (the “Services”).
This Policy applies to: Consumers who use Directive; Patients of Providers using Casenote; Providers and Candidates; Health System and Distribution Partners and their personnel; and Website Visitors.
We describe our practices in good faith and use security and privacy measures we consider reasonable for the sensitivity of the information. Statements in this Policy about our safeguards describe what we design and aim to do and are not a guarantee against every incident.
Name, phone number, email address, date of birth, address, state or county, facility or referral source, Medical Record Numbers where provided, diagnoses or health information you choose to provide, your directive answers (such as health care agent choices, treatment preferences, and organ-donation choices), the names and addresses of agents, alternates, and witnesses you designate, signature images you draw or type, and clinical session notes, POLST/MOLST forms, and Medicare identifiers where required for billing.
Names, NPI numbers, license details, malpractice coverage, resumes, geographic data, and application materials. Scout AI cross-references application identifiers against our internal performance data to prioritize candidates.
Aggregated quality indicators (such as talk/listen ratios and Competence, Courtesy, and Compassion scores) generated by Lighthouse.
Organizational identifiers (such as TIN and institutional NPI), contact and messaging endpoints, and administrative user credentials.
IP address, device and browser information, session timestamps, error logs, security logs and authentication tokens, and usage events needed to operate, secure, and support the Services.
Emails, texts, or messages you send us or that we send you (for example, one-time passcodes and links to your document).
This section applies to the ClarityACP Chrome browser extension used by credentialed Nurse Practitioners and authorized facility staff to submit patient referrals and retrieve session notes (the “Extension”). It supplements, and does not replace, the rest of this Policy.
The Extension does not connect to, integrate with, or read data from Epic or any other electronic medical record (EMR) system. It has no application programming interface (API) access, no application launch integration, and no ability to read, scrape, or extract content from any webpage, including EMR sessions open in the same browser. All information entered into the Extension is typed manually by the user.
The Extension collects only the following, entered directly by the authorized user:
Data entered into the Extension is transmitted via encrypted HTTPS connection directly to ClarityACP’s own backend infrastructure for the sole purposes of processing the referral or authorizing the requested document. This information is not sold, rented, or shared with third parties for advertising or marketing purposes.
The Extension stores a signed authentication token locally on the user’s device (via the browser’s extension storage) to avoid repeated OTP entry. This token is device-specific and expires automatically after thirty (30) days. The Extension does not persist patient information locally beyond what is required to complete an active referral or download request.
Session notes are delivered via a time-limited, single-use secure link generated at the time of request and downloaded directly to the user’s device through the browser’s native download function. ClarityACP does not maintain a publicly accessible repository of session note files.
The Extension requests only the minimum browser permissions necessary for its functions: local storage (for the authentication token), file downloads (for session notes), and network access limited to ClarityACP’s own domains. The Extension does not request, and cannot be granted, access to other websites, browser tabs, clipboard contents, camera, or microphone.
Lighthouse is designed to process audio, visual, and speech signals on the authorized Provider’s own device and to send derived metadata (such as talk/listen percentages) to our servers rather than continuously streaming raw media for this purpose.
Scout AI performs automated matching and prioritization of Provider candidates. It is one input to a human-reviewed process. Candidates may request human review or, where applicable law provides, opt out of automated profiling (Section 8).
Directive uses your answers to populate the state form you select. It does not decide what your document should say, and it does not use automated decision-making that produces legal or similarly significant effects about you.
We do not sell your personal information or PHI, and we do not share it for cross-context behavioral advertising. We disclose information only as follows:
For Patients, we send clinical notes and documents to the referring provider or Health System Partner. For Directive users who arrive through a Distribution Partner’s link, see Section 5.5.
We use service providers to host and secure data, store files, deliver video, email, and text messages, and operate the Services. They may access information only to perform services for us and are bound by confidentiality and, where PHI is involved, business associate obligations.
We may disclose information where we believe in good faith it is required by law, subpoena, court order, or regulator inquiry (including HHS OCR), or is reasonably necessary to protect health, safety, rights, or property, or to prevent fraud or abuse.
If ClarityACP is involved in a merger, acquisition, financing, or sale of assets, information may be transferred subject to this Policy or its successor.
I agree that ClarityACP may use de-identified, aggregate data from our organization's outreach and completion activity (e.g. link engagement and completion rates) for research, benchmarking, and program improvement, and to support conversations with health plans covering our patients. No individually identifiable patient information will be shared without separate authorization. A Distribution Partner does not receive individually identifiable Directive information beyond what is needed to deliver the Services, and aggregate reporting will not include information that could reasonably identify a specific person.
We may create and use de-identified or aggregate data (for PHI, de-identified in accordance with 45 C.F.R. § 164.514) for research, benchmarking, and to improve the Services, and will not attempt to re-identify it.
We share information when you tell us to, for example when you download a document, email it, or give it to an agent, physician, or facility. Once you have downloaded or shared a document, its protection is up to you and the recipient.
We use administrative, technical, and physical safeguards that we consider reasonable for the sensitivity of the information, which may include encryption in transit and at rest, role-based access controls, authentication measures, audit logging, and time-limited access links. In-session chat within Casenote is designed to be ephemeral unless a file is explicitly saved to the clinical record. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You share responsibility: use strong, unique credentials; keep your devices, email, and links private; log out of shared devices; and be careful about where you store and to whom you give copies of your documents. If we become aware of a breach affecting your information, we will notify you and regulators as required by law.
We may retain information longer where required by law, for legal holds, or to establish or defend legal claims. When data is no longer needed, we delete, de-identify, or securely destroy it consistent with industry practice.
Depending on where you live and how you use the Services (including under HIPAA, CCPA/CPRA, and other state privacy and consumer-health-data laws), you may have the right to request access to, correction of, deletion of, or a copy of your personal information; to know the categories of information collected, sources, purposes, and recipients; to opt out of sale, sharing, targeted advertising, and certain profiling (we do not sell or share for advertising); to limit use of sensitive information; to withdraw consent where we rely on it; to appeal a denial; and not to be discriminated against for exercising rights. Prospective Providers may request human review of Scout AI outputs.
To make a request, email privacy@clarityacp.com. We may need to verify your identity, and an authorized agent may submit a request with proof of authority. We may decline or limit requests where permitted by law, for example where PHI or records must be retained by law, or where fulfilling a request would infringe another person’s rights. We will respond within the time required by law. If we deny an appeal you may contact your state attorney general. Requests concerning PHI held on behalf of a healthcare provider may be directed to that provider.
Documents you have already downloaded, printed, or shared cannot be recalled by us. Deleting your account or data with us does not revoke a signed directive; revoking a directive is done according to your state’s law.
We use cookies and similar technologies that are necessary to operate and secure the Services (for example, to keep you signed in and to remember your session). We do not use cookies or trackers for cross-context behavioral advertising and do not sell or share personal information for advertising. If we add analytics or other non-essential technologies, we will update this Policy and, where required, obtain consent or honor opt-out preference signals. You can control cookies through your browser settings; disabling necessary cookies may prevent the Services from working.
If you provide a mobile number or email address, we may send transactional messages such as one-time passcodes, links to your document, and reminders related to your request. Message and data rates may apply. Reply STOP to opt out of texts (some messages essential to the Services or security may still be sent by email). We do not use your number for marketing without separate consent.
The Services are for adults 18 and older. We do not knowingly collect information from children. If you believe a child has provided information to us, contact privacy@clarityacp.com and we will delete it.
We operate in the United States and process information here. If you access the Services from outside the United States, you consent to the transfer and processing of your information in the United States.
The Services may link to government or other third-party sites. We do not control and are not responsible for their privacy practices.
We may update this Policy. We will post the updated version with a new effective date and, for material changes, give notice as described in our Terms. Continued use after the effective date means you accept the updated Policy, except where the law requires your affirmative consent.
ClarityACP LLC
Attn: HIPAA Privacy & Security Officer
Email: privacy@clarityacp.com
To file a HIPAA complaint you may contact the U.S. Department of Health and Human Services, Office for Civil Rights (OCR). We will not retaliate against you for filing a complaint.