Privacy Notice for the Patient Portal and the Domi Apps

1. Who we are and whose data it is

Domi Medical LLC (“Domi”, “we”) makes Domi EMR, the software your medical practice uses to keep its records, and the apps and portal through which you reach them. We are a software company, not a health care provider, and we are not your practice.

The health information you see in the portal or the Domi Patient app is your practice's record of you. Your practice is the HIPAA covered entity. We are its business associate: we run the software, keep the data safe, and do nothing else with it. A written agreement with every practice says so.

Your practice's own Notice of Privacy Practices describes how it uses and shares your health information. This notice describes what the apps and portal themselves collect and where it goes.

2. What the apps and portal collect

• Your sign-in account. The email or phone you sign up with, your password and your second factor are held by the identity provider in our US cloud account, under a business associate agreement with that provider. The app itself never sees your password.
• Which chart your account opens. The invitation code you redeemed and your date of birth, used once to bind your account to your chart so the portal opens your record and no one else's.
• The record you are shown. Problems, medicines, allergies, results, visits, messages, forms and bills, read from your practice's database. The app keeps a sign-in token for the open tab only and does not store your record on the device.
• What you do in the portal. Each view, download, send, message, booking, payment and consent is written to your practice's audit log, which HIPAA requires, and is shown to you as your own activity history.
• A push notification token, if you allow notifications. One entry per device, with the device platform, so we can tell you something is waiting. It is requested only after you sign in, never at launch, and deleted with your account.
• Camera and microphone, during a video visit only. Streamed, encrypted, so your clinician can see and hear you. Nothing is recorded, and the device check before a visit stays on your device.
• Your language preference. So the portal can show English or Spanish.
• A payment card, if you choose to pay or keep a card on file. It goes directly to your practice's payment processor; only a token comes back to us.

What we do not collect: no advertising identifier, no location, no contacts, no analytics or tracking software, no third-party script. The native apps add only the runtime that wraps the portal and the push notification plugin.

A push notification or a text says that something is waiting, such as a message, a result or an appointment, and never the content.

3. How it is used, and never used

Only to provide the portal and apps to you and your practice, to keep them secure, to meet legal obligations, and as our agreement with your practice allows.

Never: sold; used for advertising; shared with data brokers; used to train an artificial-intelligence model; or de-identified or aggregated for our own purposes without your practice's written consent.

If your practice has switched on the clinical assistant, it may draft text for a clinician from your record. Each request is logged with counts, never the text; no copy is kept by the model service; and the clinician reviews and signs everything. Nothing you type in the portal is sent to the assistant.

4. Where the data lives

All data is stored and processed in the United States, on Amazon Web Services, under a business associate agreement with AWS. It is encrypted in transit and at rest with keys we manage. We do not store or process it outside the United States.

5. Who can see it

• Your practice's staff: your record, as their role allows. Every access is logged.
• A representative your practice authorized: your record, under an authorization the practice grants and can revoke. Every access is logged with their name.
• An app you connect: what you let it read, by your choice, revocable in the portal. The app is yours; we are not responsible for what it does with your information.
• Domi staff: nothing by default. Support access is a time-limited grant with a written reason, approved by a second Domi person, visible to and revocable by your practice, recorded in the practice's audit log, and unable to write clinical data.
• Our service providers: hosting, email, text, voice and video delivery, the payment processor (card tokens only), and the vendors behind add-ons your practice turns on, each under a business associate agreement with Domi.
• Authorities: when the law requires.

6. How long it is kept

Your medical record is kept for as long as your practice's record-retention obligations require; that is your practice's decision, not ours. The audit log is kept for at least six years. A push token is deleted when the account is, or when the app registers a new one. When a practice leaves Domi, its whole record is returned to it and then deleted from our systems on a published schedule; backups cannot be erased early and expire on their own schedule.

7. Children

The Domi Patient app is not directed to children under 13 on their own, and a child does not create an account. A parent or guardian reaches a child's chart only as a representative the practice has authorized.

8. Your rights

Your rights over your health information are HIPAA rights, and they are exercised through your practice: the right to see and get a copy of your record, to ask for a correction, to an accounting of disclosures, to ask for a restriction, and to complain to the practice or to the U.S. Department of Health and Human Services. Your practice decides those requests; we do not, and we cannot act on them without it.

The portal gives you a copy of your record on demand, a history of who has seen or sent your record from the portal, and a way to ask for a restriction. If you contact us directly, we pass your request to your practice within five business days.

9. Security

Staff sign-in requires multi-factor authentication. Each practice's data is separated from every other's in the database. The audit log is append-only and tamper-evident. The portal keeps you signed in only for the open tab. A video-visit link works once, expires, and asks for your date of birth.

If a breach affects your information, your practice is told within five business days of our discovering it, and tells you as the law requires.

10. The staff app

The Domi EMR app for practice staff collects the same sign-in and push items as the patient app, for a staff member's own account, and shows notifications that name a queue, never a patient. What a staff member does in it is logged in the practice's audit log.

11. Store disclosures

For the App Store privacy label and the Google Play data-safety form, for both apps. Health information is your practice's and is shown to you rather than collected by Domi for its own purposes; the stores define “collect” as transmitted off the device, so it is declared as collected and linked to you.

• Contact info (email or phone at sign-up): collected by the identity provider, linked to you, used for sign-in. Not used for tracking.
• Health information (the record shown): collected, linked to you, used for app functionality. Not used for tracking.
• Financial information (payment card): not collected by Domi; entered into the processor's own field, a token only.
• Identifiers (your account id): collected, linked to you, used for app functionality.
• Device id (push token and platform): collected only if you allow notifications, linked to you, used for notifications.
• Usage data (your actions in the app): collected into your practice's audit log, linked to you, used for app functionality and HIPAA record-keeping.
• Diagnostics or crash data, location, contacts, photos, browsing, search history, purchases: not collected.
• Camera and microphone: used only during a video visit; nothing is stored.
• In every case: encrypted in transit; deletion requested through your practice; no third-party advertising; no data shared with third parties other than service providers under contract.

12. Changes

We post the new version at this address and change the date at the top. Your practice is told of a material change under its agreement with us and tells you as its own notice requires.

13. Contact

• Your record, your care, your rights: your practice, shown on every portal page.
• This notice, the software, a security concern: Domi Medical LLC, admin@domimedical.com.
• A HIPAA complaint: your practice's privacy officer, or the HHS Office for Civil Rights at hhs.gov/ocr.