Privacy Policy

2.1 Service Delivery. To provide, maintain, and improve the clinical decision support services, including record organization, impairment calculations, compliance checking, report structuring, and audit trail generation.

2.2 Account Management. To manage your account, authenticate your identity, process subscription and per-report payments, and communicate with you about your account status.

2.3 Audit and Compliance. To maintain comprehensive audit trails as required by HIPAA (45 CFR §164.312(b)) and to support the medical-legal defensibility of reports generated through the Platform. Audit logs record every access to PHI, every modification to report content, and every administrative action.

2.4 Service Communications. To send transactional communications including account verification, password resets, billing notifications, report status updates, workflow completion alerts, and security notices. These communications are essential to the service and cannot be opted out of.

2.5 Security. To detect, investigate, and prevent security incidents, unauthorized access, fraud, abuse, and violations of our Terms of Service.

2.6 Legal Compliance. To comply with applicable federal and state laws, regulations, legal processes, and enforceable governmental requests.

PHI is never used for marketing, advertising, product development, model training, or any purpose not directly related to delivering the services you have requested.

3.1 Business Associate Status. AtlasMD operates as a Business Associate under HIPAA when processing PHI on behalf of Covered Entities. We execute Business Associate Agreements ("BAAs") with all customers who are Covered Entities or Business Associates. A BAA must be executed before any PHI is uploaded to the Platform. To request a BAA, contact security@getatlasmd.com.

3.2 Minimum Necessary Standard. We apply the HIPAA Minimum Necessary standard to all uses and disclosures of PHI. Access to PHI is limited to the specific information reasonably necessary to accomplish the intended purpose of the use, disclosure, or request.

3.3 Access Controls. PHI is protected by role-based access controls (RBAC). Physician account holders control which delegates have access to their cases. Delegates cannot access PHI beyond what is necessary for their assigned case responsibilities. AtlasMD personnel access to PHI is restricted to authorized support and engineering staff acting under confidentiality obligations and only when necessary for Platform operations.

3.4 Encryption. All PHI is encrypted at rest using AES-256 encryption and in transit using TLS 1.3. Encryption keys are managed through industry-standard key management services and are never stored alongside encrypted data.

3.5 Audit Controls. The Platform maintains a complete, tamper-resistant audit trail of all access to PHI, all modifications to report content, all administrative actions, and all authentication events, in compliance with 45 CFR §164.312(b). Audit logs are retained for a minimum of six (6) years.

3.6 Breach Notification. In the event of a breach of unsecured PHI as defined under 45 CFR §164.402, AtlasMD will notify affected Covered Entities without unreasonable delay and no later than sixty (60) days following discovery of the breach, as required under the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D). The notification will include the information specified in 45 CFR §164.410(c).

4.1 AI-Assisted Processing. The Platform uses artificial intelligence and machine learning technologies to organize medical records, perform AMA Guides impairment calculations, structure report sections according to applicable regulatory requirements (including CCR §39 and §41), and identify potential compliance gaps. These AI/ML capabilities are clinical decision support tools — they assist the physician but do not replace physician judgment, author clinical opinions, or make independent clinical determinations.

4.2 Physician Authorship. In accordance with California Labor Code §4628, the physician of record remains the sole author of every report generated through the Platform. The physician conducts the examination, reviews all records, exercises clinical judgment, writes all clinical opinions (including causation, apportionment, impairment, and work restrictions), and signs the report under penalty of perjury. AtlasMD provides structured documentation support — it does not participate in the nonclerical preparation of the report within the meaning of LC §4628.

4.3 AB 1293 Compliance. In compliance with California Assembly Bill 1293, physicians using AtlasMD are encouraged to disclose in their reports that structured documentation software was used for record organization and calculation support, consistent with existing disclosure practices for dictation services, calculators, and other clinical tools. AtlasMD provides model disclosure language to all subscribers.

4.4 No Model Training on PHI. PHI processed through the Platform is never used to train, fine-tune, improve, or evaluate any AI or machine learning model. PHI submitted to third-party model providers for processing is subject to zero-retention agreements — it is not stored, logged, cached, or used for any purpose beyond the immediate processing request.

6.1 Account Data. Account information is retained for the duration of your active subscription and for thirty (30) days following account termination to allow for data export and account recovery.

6.2 Case Data and Reports. Case files, uploaded documents, and generated reports are retained for the duration of your active subscription. Upon termination, case data is retained for thirty (30) days and then permanently deleted unless a longer retention period is required by law or requested by you in writing.

6.3 Audit Logs. Audit trail records are retained for a minimum of six (6) years from the date of creation, in compliance with HIPAA requirements (45 CFR §164.530(j)). Audit logs cannot be deleted upon request because they constitute legally required compliance records.

6.4 PHI at Sub-Processors. PHI transmitted to AI model providers for processing is subject to contractual zero-retention obligations. PHI is not retained by model providers beyond the real-time processing window. There is no persistent storage of PHI at any model provider.

6.5 Deletion Requests. You may request deletion of your case data at any time by contacting privacy@getatlasmd.com. We will process deletion requests within thirty (30) days. Deletion of PHI does not affect the retention of audit logs, which must be maintained per HIPAA.