Privacy Policy

1. Who we are

Aegle Management LLC ("Aegle," "we," "us," or "our") provides healthcare operations, administrative support, and technology services to medical practices, physician groups, and other healthcare organizations in the United States. Our services include an AI-assisted inbound telephone assistant, call-center and patient-retention support, scheduling coordination, credentialing and eligibility support, documentation support, and related back-office operations.

Our principal place of business is 1304 W Holt Blvd, Suite A, Ontario, California 91762, and our website is aegle.care.

2. Our role and this policy's scope

Aegle is a Business Associate as that term is defined under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, "HIPAA"). We are not a healthcare provider, we do not practice medicine, and we do not make clinical decisions.

When we handle protected health information ("PHI"), we do so on behalf of, and at the direction of, the healthcare provider or organization that engaged us (the "Covered Entity"), under a written Business Associate Agreement ("BAA"). The Covered Entity — not Aegle — controls that information and determines how it may be used.

What this means for patients: if you are a patient of a practice that uses Aegle's services, your medical record belongs to your healthcare provider. Requests to access, correct, restrict, or obtain a copy of your health information should be directed to your provider, who will handle them under their own Notice of Privacy Practices. We will support your provider in responding to those requests.

This policy describes our privacy practices for: (a) PHI we process on behalf of Covered Entities; (b) information collected through our AI telephone assistant and call-center services; (c) data accessed through electronic health record ("EHR") and health-data interfaces; and (d) information collected through our website and business communications. Where a BAA or a written services agreement with a Covered Entity imposes stricter obligations than this policy, that agreement controls.

3. Information we collect

3.1 Health and patient information (on behalf of providers)

In delivering services to healthcare clients, we may receive, access, or create the following categories of information about patients:

• Identifiers: full name, date of birth, mailing address, telephone number, email address, and patient or medical record identifiers.
• Coverage and eligibility information: health plan or insurance name, member or subscriber identifier, group number, assigned provider or medical group, and eligibility status.
• Appointment and scheduling information: appointment dates, times, locations, visit types, assigned clinicians, and the reason for the visit as stated by the caller.
• Request and task information: prescription refill requests, pharmacy details, referral and prior-authorization requests, medical-records requests, demographic-change requests, and messages intended for clinical staff.
• Limited clinical information that a caller volunteers or that is necessary to route a request appropriately — for example, a stated symptom or medication name.
• Call content: telephone audio and/or written transcripts of calls handled by our AI assistant or our agents, together with call metadata such as date, time, duration, caller telephone number, and the outcome or task created.

3.2 Information from healthcare clients and their systems

We receive information directly from our healthcare clients and, where authorized, from the systems they use — including EHR platforms, practice-management systems, scheduling files, and secure data exports — for the sole purpose of performing the services they have engaged us to perform.

3.3 Business and website information

We collect ordinary business-contact information (such as name, employer, role, email address, and telephone number) from prospective and current clients, vendors, and job applicants, and we collect limited technical information from visitors to our website as described in Section 18.

4. How we use information

We use PHI and other patient information only to perform the services requested by the Covered Entity, as permitted by our BAA, and as required or permitted by law. Specific uses include:

• Answering inbound patient calls and verifying a caller's identity before any information is discussed or changed.
• Capturing, scheduling, rescheduling, and confirming appointments, and communicating those details back to the patient and to clinic staff.
• Recording and routing requests — refills, referrals, prior authorizations, records requests, demographic updates, and clinical questions — to the appropriate person or department at the practice.
• Coordinating eligibility checks, insurance assignment, credentialing support, and related administrative follow-up.
• Communicating with pharmacies, hospitals, health plans, and other providers strictly at the direction of the practice and only to the minimum extent necessary.
• Maintaining call logs, task records, and audit trails so the practice has an accurate operational record.
• Providing support, quality assurance, troubleshooting, service improvement, and reporting to the practice.
• Detecting, investigating, and preventing fraud, abuse, security incidents, and misuse of our systems.
• Meeting our legal, regulatory, and contractual obligations.

We apply the HIPAA minimum necessary standard: we request, access, use, and disclose only the information reasonably needed to accomplish the specific purpose at hand.

5. What we never do with your data

We want to be explicit about our limits. Aegle does not:

• Sell personal information or PHI to any party, under any circumstances.
• Rent, trade, or share personal information or PHI for advertising, marketing, or commercial profiling purposes.
• Use PHI to build advertising profiles, or disclose it to advertising networks or data brokers.
• Use PHI to train, fine-tune, or improve any publicly available or general-purpose artificial-intelligence model, and we do not permit our AI vendors to do so with data processed on our behalf.
• Access, use, or disclose PHI for any purpose beyond the services described in our agreement with the Covered Entity.
• Provide medical advice, diagnose conditions, interpret test results, or make clinical decisions.
• Disclose patient information to a caller whose identity or authorization has not been verified.
• Use PHI to make automated decisions that produce legal or similarly significant effects about an individual.

6. EHR and health-record API integrations

Where a healthcare client authorizes it, Aegle connects to that client's EHR or health-data platform through a secure application programming interface ("API"), including standards-based interfaces such as HL7® FHIR®. The following describes our data usage for those integrations.

7. Artificial intelligence and voice services

Our telephone assistant uses automated speech recognition, natural-language processing, and speech synthesis to understand and respond to callers. We believe patients are entitled to know when they are speaking with an automated system, so:

• The assistant identifies itself as an AI assistant at the start of the call, and will confirm that it is not a person if asked.
• A caller may ask for a human at any time and will be transferred to a member of staff or offered a callback.
• Emergencies take priority over everything else. If a caller describes a medical emergency, the assistant immediately directs them to hang up and dial 911 and alerts a supervisor.
• The assistant never provides medical advice or triage.
• Identity is verified before any personal information is discussed or changed, and information is not disclosed to unverified or unauthorized callers.

Humans remain accountable. Requests captured by the assistant are reviewed and completed by qualified staff at the practice. The assistant does not make clinical or coverage decisions.

Call audio and transcripts are treated as PHI, are stored within our secured environment, and are used only to deliver, document, and quality-assure the services. We use enterprise AI services under contractual terms that prohibit the vendor from using our data to train their general-purpose models, and, where PHI is involved, we obtain a Business Associate Agreement from that vendor.

Automated systems can misrecognize speech or misunderstand a request. Our workflows are designed so that a person reviews and completes captured requests, and so that no clinical or coverage outcome depends on the assistant alone.

8. Call recording and text messages

Call recording. Calls to or from numbers served by Aegle may be recorded and transcribed for quality assurance, documentation, training, and dispute resolution. California and certain other states require that all parties be notified of recording. Where recording occurs, callers are notified at the start of the call, and continuing the call after that notice constitutes consent. A caller who does not wish to be recorded may say so and will be offered an alternative, such as a callback from staff. Recordings are treated as PHI and handled under this policy and the applicable Business Associate Agreement.

Text messages. Where a practice enables it, we may send appointment confirmations, reminders, telehealth links, and similar service messages by SMS to the number a patient provides. These are transactional messages relating to care the patient has requested — not marketing. Message and data rates may apply. Patients may opt out at any time by replying STOP to any message, or by telling the practice or our staff, and may reply HELP for assistance. Opting out of text messages does not affect a patient's care or coverage.

9. When we share information

We disclose information only in the following circumstances:

• To the healthcare practice that engaged us — this is the core purpose of our services.
• At the practice's direction, to pharmacies, hospitals, specialists, imaging centers, health plans, or other parties involved in that patient's care or coverage, limited to the minimum necessary.
• To subcontractors and service providers who help us deliver the services — such as cloud hosting, telephony, speech, and AI infrastructure providers, and contracted operational personnel. Every subcontractor that may handle PHI is bound by a written agreement, including a Business Associate Agreement, imposing privacy and security obligations no less protective than our own.
• When required by law — for example, in response to a valid subpoena, court order, or lawful request from a regulator or law-enforcement authority, or to the U.S. Department of Health and Human Services in connection with a HIPAA compliance review.
• To protect safety, where disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, consistent with applicable law.
• To our professional advisors — such as auditors, insurers, and legal counsel — under duties of confidentiality.
• In a business transaction, such as a merger, acquisition, financing, or transfer of assets — in which case the recipient remains bound by the commitments in this policy and by existing Business Associate Agreements.

Our current categories of subcontractors that may process data on our behalf include: cloud infrastructure and hosting; telephony and voice transport; speech recognition, speech synthesis, and language-model services; secure data storage and backup; and contracted administrative and call-center personnel. A current list of subprocessors handling PHI is available to our healthcare clients on request, and we will give clients notice of a material change to that list as provided in their agreement.

10. Processing outside the United States

Aegle is a United States company, and our production systems for protected health information are hosted in the United States. Some of our operational, administrative, and technology personnel, and some of our contracted service partners, are located outside the United States.

Where personnel outside the United States support our services, the following apply without exception:

• Access to PHI is permitted only where the applicable healthcare client has authorized it in the services agreement or Business Associate Agreement. Where a client requires that its PHI be handled exclusively by United States-based personnel, we honor that restriction.
• All such personnel and partners are bound by written confidentiality, privacy, and security obligations — including Business Associate Agreements where required — that are no less protective than those described in this policy.
• Access is role-based, least-privilege, logged, and limited to the minimum information necessary to perform the assigned task.
• Work is performed through controlled access to systems hosted in the United States. PHI is not exported to, or stored on, personal or local devices.
• Personnel receive HIPAA privacy and security training appropriate to their role before being granted access.

Healthcare clients may request details of where and by whom their data is processed, and may impose additional geographic restrictions by agreement.

11. De-identified and aggregated information

We may create de-identified or aggregated information from data we process — for example, call volumes, answer rates, appointment conversion rates, and other operational metrics — and use it to operate, evaluate, secure, and improve our services, to produce benchmarks and reporting, and for quality-improvement and research purposes.

De-identification is performed in accordance with HIPAA standards, and de-identified information does not identify, and cannot reasonably be used to identify, any individual. We do not attempt to re-identify de-identified information, and we contractually prohibit recipients from doing so. Where our agreement with a healthcare client restricts this use, that agreement controls.

12. How we protect information

We maintain administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of the information we handle, consistent with the HIPAA Security Rule. These include:

• Encryption of data in transit using current TLS standards, and encryption of data at rest in our storage environments.
• Role-based access controls and the principle of least privilege, so personnel may access only the data their role requires.
• Unique user credentials, multi-factor authentication for administrative access, and prompt revocation of access when personnel change roles or depart.
• Audit logging of access to systems containing PHI, and monitoring for anomalous activity.
• Network protections, environment segregation, and secured configuration of cloud infrastructure.
• Workforce confidentiality obligations, background screening where appropriate, and HIPAA privacy and security training for personnel who may handle PHI.
• Written agreements, including Business Associate Agreements, with subcontractors that may access PHI.
• A documented incident-response process for identifying, investigating, containing, and reporting suspected security incidents.
• Periodic review of our safeguards, access rights, and vendor arrangements.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We do, however, commit to maintaining safeguards appropriate to the sensitivity of health information and to reviewing them regularly.

13. Data retention and deletion

We retain PHI only for as long as necessary to provide the services, to satisfy the terms of our agreement with the Covered Entity, and to meet legal, regulatory, and audit obligations. Because the Covered Entity is the custodian of the medical record, retention periods are set by our agreement with that practice, and a practice may direct a shorter or longer period.

Absent a specific instruction, we apply the following criteria:

On termination of a services agreement, we return or securely destroy PHI in accordance with the Business Associate Agreement, except where retention is required by law. Where destruction is not feasible — for example, in secure backups pending routine expiry — we extend the protections of that agreement to the retained information and limit further use to the purposes that make destruction infeasible.

14. Your rights and choices

If you are a patient: your rights over your health information — including the rights to access, obtain a copy, request an amendment, request restrictions, request confidential communications, and receive an accounting of disclosures — are exercised through your healthcare provider under HIPAA and your provider's Notice of Privacy Practices. Please contact your provider directly. If you contact us, we will refer you to your provider and assist them in responding.

If you are a client, vendor, applicant, or website visitor: you may contact us using the details in Section 20 to request access to, correction of, or deletion of the business-contact information we hold about you, or to opt out of business communications. You may unsubscribe from any marketing email using the link in that email.

15. California privacy rights

Aegle is based in California. The California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), exempts protected health information collected by a Business Associate and governed by HIPAA. Accordingly, PHI we process on behalf of healthcare clients is handled under HIPAA and our Business Associate Agreements rather than the CCPA.

For personal information that is not PHI — for example, business-contact information or website data — California residents have the following rights:

• Right to know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties to whom it was disclosed.
• Right to delete personal information we have collected, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information.
• Right to non-discrimination for exercising any of these rights.

We do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. We do not use or disclose sensitive personal information for purposes beyond those permitted without a right to limit. We do not knowingly sell or share the personal information of consumers under 16 years of age.

How to exercise a right. Contact us using the details in Section 20. We will acknowledge your request within 10 business days and respond within 45 calendar days, extendable by a further 45 days where reasonably necessary, in which case we will notify you. To protect your privacy we will verify your identity before responding, typically by matching information you provide against our records; we will not use that information for any other purpose.

Authorized agents. You may use an authorized agent to submit a request. We may require written proof of the agent's authority and may ask you to verify your own identity directly.

Opt-out preference signals. Because we do not sell or share personal information, there is nothing to opt out of; nonetheless, our website is configured to recognize and respect the Global Privacy Control (GPC) and similar browser-based opt-out preference signals where they are transmitted.

16. Children's information

Our services are not directed to children, and we do not knowingly collect personal information from children through our website. We may, however, process health information about minor patients when performing services for a healthcare practice — for example, when a parent or guardian calls to arrange care for a child. That information is handled as PHI under HIPAA, under the direction of the practice, and consistent with applicable state law regarding minors' health information and the circumstances in which a minor may control their own records.

17. Breach notification

If we discover a breach of unsecured protected health information, we will notify the affected Covered Entity without unreasonable delay and in any event within the timeframe required by HIPAA and our Business Associate Agreement. Our notice will identify the individuals affected, describe what occurred and when, and provide the information the Covered Entity needs to meet its own notification obligations. We will cooperate fully in investigating, mitigating, and documenting the incident, and will take reasonable steps to prevent recurrence. Where other law requires notice of a security incident involving personal information, we will comply with that law as well.

18. Website visitors and cookies

When you visit aegle.care, we may collect limited technical information such as IP address, browser type, device type, referring page, pages viewed, and time on page, using cookies and similar technologies. We use these to keep the site secure and functioning and to understand general usage patterns.

The cookies we use fall into two categories: strictly necessary cookies, which are required for the site to operate and cannot be switched off; and analytics cookies, which help us understand aggregate traffic. We do not place third-party advertising or retargeting trackers on our site, and we do not use website data to build advertising profiles. Most browsers allow you to refuse or delete cookies; doing so may affect how parts of the site function.

If you submit a contact form, we use the details you provide to respond to your inquiry and to maintain a record of the correspondence.

Please do not send protected health information or sensitive health details through our website contact form or by ordinary email. These channels are not secured for that purpose. If you need to send health information, contact us and we will provide a secure method.

19. Changes to this policy

We may update this policy from time to time to reflect changes in our services, technology, or legal obligations. The "Last updated" date at the top of this page shows when it was last revised, and prior versions are available on request. Material changes will be posted on this page, and where a change materially affects our handling of PHI, we will notify affected healthcare clients as required by our agreements with them.

20. How to contact us

For questions about this policy, to exercise a privacy right, or to report a privacy or security concern:

We will acknowledge privacy inquiries promptly and aim to resolve them quickly. If you are a patient with a concern about how your health information was handled, you may also contact your healthcare provider directly, or file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/complaints. We will not retaliate against anyone for filing a complaint or exercising a privacy right.

This policy is governed by the laws of the State of California and applicable United States federal law.