Legal

Privacy Policy

Your privacy and the security of your personal health information are our highest priorities. This policy transparently outlines how we protect, use, and safeguard your information while providing exceptional virtual healthcare services.

Introduction

TeleTonicMD ("we," "our," or "us") is committed to protecting your privacy and maintaining the confidentiality of your personal health information. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our virtual primary care services, monthly Direct Primary Care subscription plans, visit our website at www.teletonicmd.com, or receive in-home care services.

HIPAA Compliance

As a healthcare provider, we are required to comply with the Health Insurance Portability and Accountability Act (HIPAA) and its Privacy Rule. This Privacy Policy works in conjunction with our HIPAA Notice of Privacy Practices, which provides additional details about how we use and disclose your protected health information (PHI).

Information We Collect

Personal Health Information (PHI)

• Medical history and current health conditions
• Symptoms, diagnoses, and treatment plans
• Prescription and medication information
• Laboratory and diagnostic test results
• Insurance information
• Emergency contact information
• Voice recordings and transcripts: when you use voice dictation, when you allow the AI scribe for a visit, or when your physician dictates about your care

Personal Information

• Name, address, phone number, and email address
• Date of birth and Social Security number
• Payment and billing information
• Communication preferences

Technical Information

• IP address and device information
• Browser type and operating system
• Website usage data and analytics
• Video call quality and connection data
• Login times and session information

How We Use Your Information

Treatment

• Providing virtual and in-home medical consultations
• Developing and implementing treatment plans
• Coordinating care with other healthcare providers
• Emergency medical situations

Payment

• Processing payments for services
• Managing monthly Direct Primary Care subscription payments
• Billing and insurance claim processing
• Financial assistance and payment plan management

Healthcare Operations

• Quality assurance and improvement
• Staff training and education
• Compliance with legal and regulatory requirements
• Business administration and planning

Communication

• Appointment reminders and scheduling
• Follow-up care instructions
• Health education and wellness information
• Service updates and announcements

How We Share Your Information

With Your Consent

• When you provide written authorization
• For purposes you specifically approve

For Treatment, Payment, and Operations

• With healthcare providers involved in your care
• With insurance companies for payment processing
• With business associates who provide services to us

As Required by Law

• To comply with legal obligations
• To respond to court orders or subpoenas
• For public health and safety purposes
• To prevent serious harm or illegal activity

Emergency Situations

• To emergency responders when necessary for your safety
• To family members or emergency contacts in crisis situations

AI Assistant (AzTechTonic AI) and Third-Party AI Services

TeleTonicMD offers an optional AI assistant, AzTechTonic AI, in our website chat, patient portal, and mobile app. When — and only when — you choose to use it, we send your conversation to a third-party AI service to generate a response. We ask for your explicit permission in the app and on the patient portal before anything you type or dictate into the assistant is sent. You can decline, and you can withdraw your consent at any time in Privacy Settings in the app or under Privacy choices on the patient portal.

• What we send: the messages you type or dictate into the assistant. If you are signed in and ask about your own care, the assistant may also use relevant details from your record (such as your appointments, medications, invoices/balance, lab & radiology reports, or insurance) to answer your question. It cannot access anyone else's information. The public website assistant is anonymous and is not given any personal or health-record data.
• How we collect it: directly from what you type or dictate in the AzTechTonic AI chat. Nothing is sent to the AI unless you start a conversation with it after granting consent.
• Who it is sent to: Google Cloud Vertex AI (Gemini), which processes the request to generate a reply. If you dictate a message, Google Cloud Speech-to-Text first converts your recording into text (see Voice Dictation and the AI Scribe). When the assistant looks up medical literature, general (de-identified) topic queries — never your personal information — may be sent to public reference services (the U.S. National Library of Medicine's PubMed and MedlinePlus, ClinicalTrials.gov, and the U.S. FDA's openFDA).
• How your data is used: only to generate the assistant's response to you and to keep an encrypted history of your own conversations. Your data is not used to train Google's AI models or for advertising. Like every request to Google's Gemini models, these requests are subject to Google's automated misuse screening, which is described below.
• Equal protection: Google Cloud Vertex AI and Speech-to-Text are HIPAA-eligible services that Google provides to TeleTonicMD under a signed Business Associate Agreement (BAA), so your protected health information receives the same protections it does with us. Data is encrypted in transit and at rest.

AzTechTonic AI provides general information and help with your care and our services; it does not provide a medical diagnosis and is not for emergencies. If you do not consent, the AI assistant is simply unavailable — all other features of the app and portal continue to work normally.

Your Physician's Use of AI

Separately from the assistant you use, your physician may use clinical AzTechTonic AI tools, which run on Google Cloud Vertex AI (Gemini) and Speech-to-Text under the same Business Associate Agreement. These tools help your physician find and summarize information in your chart; dictate, organize, and proofread notes; draft visit notes with the AI scribe (see Voice Dictation and the AI Scribe); and suggest updates to your chart. Nothing the AI produces is added to your chart until your physician reviews and confirms it. The AI scribe is used only with your permission. The other tools are part of your treatment and our health care operations, so they do not require your separate permission.

Voice Dictation and the AI Scribe

TeleTonicMD offers two optional voice features: voice dictation, which turns what you say into text that you review before sending, and the AzTechTonic AI scribe, which, with your permission, listens to a visit to help your physician write the visit note.

Voice Dictation

• When we collect it: only while you are recording, after you tap a microphone button in the app or on the patient portal. Each recording stops when you tap the button again or after 55 seconds. We ask for your permission before you dictate for the first time.
• How it is processed: your recording is sent securely to our server, which uses Google Cloud Speech-to-Text to convert it into text. Our server processes the audio in memory and discards it as soon as transcription is finished; the audio is never saved to disk or to a database. The app deletes its own temporary copy of the recording as soon as the text comes back, or if transcription fails. On the patient portal, the recording is held only in your browser's memory and is never saved to your device.
• What happens to the text: the text appears on your screen so that you can review, edit, or delete it. The text is not sent to your care team or to AzTechTonic AI until you choose to send it. Once sent, it is handled like anything else you type.
• Clinicians: your physician may dictate notes and messages about your care, and those recordings are handled in the same way. Your physician may also use Gemini on Vertex AI to organize a dictated note or to proofread it for grammar and clarity, and reviews the result before saving it.

AzTechTonic AI Scribe

With your permission, your physician may use the AzTechTonic AI scribe during a visit. The scribe listens to the conversation, creates a written transcript, and drafts a visit note, so that your physician can focus on you instead of typing.

• Your permission, for each visit: the scribe is used only if you agree for that specific visit. During a video visit, the request appears on your own device, in the TeleTonicMD app or on the patient portal, and only you can accept it there. For an in-person or phone visit, or if you cannot respond on your screen, your physician explains the scribe out loud, asks for your permission and the permission of anyone else present, and records in our system that you all agreed. If you say no, the scribe is not used, and the visit continues as usual. If you say no on your own device, only you can change that answer for the visit.
• Everyone present must agree: everyone present during the visit must agree to the scribe listening, wherever you and they are located. When you allow the scribe from your own device, we ask you to tell us whether anyone else is with you and to make sure they agree before you tap Allow, and we record your answer. If anyone present does not agree, please tap No thanks.
• Stopping the scribe: when you allow the scribe from your own device, a notice stays on your screen while it is listening. You can stop it at any time by tapping Stop AI scribe or by asking your physician to stop it, and it stops listening within a few seconds. Audio recorded before it stopped may still be transcribed and used to draft your note. If you would like the transcript and draft from that visit deleted, ask your physician, who can delete them and can remove any drafted text from your note before signing it.
• What it collects: the audio of the visit conversation, which may include your voice, your physician's voice, and the voices of anyone else present, along with the transcript made from it. To keep the note accurate, the transcript labels who said what (for example, "Clinician," "Patient," or "Other"), which the AI works out from what is said and from how the voices differ within that visit's recording.
• No voiceprints: neither voice dictation nor the AI scribe creates or keeps a voiceprint or any other biometric identifier, and neither is used to recognize who anyone is by their voice.
• Chart information the AI uses: to draft the note, the AI also receives the visit date, the text already in your note (which can include details filled in from your chart, such as your name and date of birth), and the chart information it needs to write the note accurately: your age, sex, problem list, medications, allergies, health history, and intake-form answers. It is not given your contact information, insurance details, or secure messages.
• How the audio is handled: the scribe records the conversation on your physician's device, which during a video visit can include your voice as it comes through the call. If you allowed the scribe from your own device, it also records your microphone there. The audio is sent to our server in segments of up to about 10 minutes. Each segment is deleted from your device once our server has received it, and from your physician's device once it has been transcribed; it is also deleted if it cannot be uploaded or transcribed. Any segment left behind by an interrupted session is deleted the next time the app opens or when you sign out. Our server, which works only in memory and never saves the audio to disk or to a database, sends each segment to Google's Gemini models on Vertex AI to be transcribed.
• Transcripts and drafts: the transcript is stored in encrypted form as it is created during the visit, and so is the AI's draft, so that your physician can finish your note. The scribe's copies are deleted automatically 30 days after the most recent draft is created, or 24 hours after the scribe starts if no draft is created, and your physician can delete them sooner. Anything your physician copies from the draft into your visit note becomes part of that note, and a signed note is kept as part of your medical record. The transcript itself is not added to your medical record, but while we keep it, you may ask for a copy, as with any other health information we hold about you.
• How your physician uses it: the AI only prepares a draft, and drafts can contain mistakes. Your physician reviews every draft and corrects it as needed, and nothing from the scribe is added to your medical record until your physician has approved and signed the note. Changes to your medication, allergy, and health-history lists are made only when your physician approves each one.

Who Processes Your Voice Data

• Google Cloud, under a BAA: voice dictation uses Google Cloud Speech-to-Text, and the AI scribe uses Google's Gemini models on Google Cloud Vertex AI. Google provides both HIPAA-eligible services to TeleTonicMD under our signed Business Associate Agreement (BAA). We do not send your recordings or transcripts to any other outside company. If you use your phone's or computer's built-in keyboard dictation instead of our microphone button, the maker of your device or keyboard (for example, Apple or Google) handles that audio under its own privacy terms rather than ours.
• Additional safeguards: your data is encrypted in transit, and Google does not use it to train its AI models. We have not joined Google's optional Speech-to-Text data-logging program, and we have turned off Vertex AI's prompt caching for our account, so Google does not keep a cached copy of your requests.
• Google's misuse screening: Google automatically screens requests to its Gemini models for misuse of its service. If a request is flagged, Google may keep it for up to 90 days so that authorized Google staff can check for that misuse. Any request kept this way stays in the U.S. region we use, remains covered by our BAA, and is never used to train Google's models.

Your Choices

• Always optional: you can always type instead of dictating, and you can say no to the AI scribe at any visit, even if you allowed it before. Declining never affects your care; the visit continues as usual, and your physician takes notes without the scribe. You can also ask your physician to stop the scribe before discussing anything you would rather not have transcribed, such as mental health or substance use.
• Withdrawing permission: the current AzTechTonic AI notice also describes voice dictation, so agreeing to it also lets you dictate. You can withdraw at any time. In the app, open Privacy Settings; to turn voice dictation off completely, withdraw both your AzTechTonic AI consent and your voice dictation consent. On the patient portal, use Privacy choices on the AzTechTonic AI page or Voice dictation settings in Secure Messages; either one withdraws both. Permission for the AI scribe is asked for separately at each visit.
• Records of your choices: we keep a record of each time you give or withdraw permission for these features, including when you did so, how you did so (in the app, on the portal, or out loud to your physician), and which version of our consent wording you agreed to. These records never include your recordings or what was said.

Website and Technology Security

Data Security Measures

• End-to-end encryption for all video consultations; if you allow the AI scribe, audio from the visit is also sent securely from the devices on the call to our server for transcription (see Voice Dictation and the AI Scribe)
• Secure, HIPAA-compliant servers and databases
• Multi-factor authentication for account access
• Regular security audits and updates
• Secure payment processing systems

Cookies and Tracking

• We use cookies to support core website functionality
• You can disable cookies in your browser settings
• We do not use third-party advertising or tracking services

Any usage measurement we perform is first-party, aggregated, and de-identified, and is used only to understand and improve website performance. We do not sell your information, and we do not share your protected health information (PHI) with analytics or marketing providers except as permitted by law or under a Business Associate Agreement (BAA).

Your Rights and Choices

Under HIPAA and applicable privacy laws, you have the right to:

Access and Control

• Request copies of your medical records
• Request corrections to inaccurate information
• Request restrictions on how we use your information
• Request alternative forms of communication

Account Management

• Update your contact and personal information
• Modify communication preferences
• Delete your account (subject to legal retention requirements)

Complaints

• File complaints about our privacy practices
• Contact the Department of Health and Human Services
• File complaints without fear of retaliation

Telehealth-Specific Privacy Considerations

Video Consultations

• Consultations are conducted on secure, encrypted platforms
• Visits are not recorded without your explicit consent; if you allow the AI scribe, the audio is used only to create a transcript for your physician's note and is not kept by TeleTonicMD (see Voice Dictation and the AI Scribe)
• You should ensure privacy in your consultation location
• Family members may be present with your permission; if the AI scribe is in use, everyone present must also agree to it

Technical Requirements

• Stable internet connection required for optimal care
• We recommend using updated browsers and devices
• Public Wi-Fi should be avoided for consultations
• Device security is your responsibility

Data Retention

We retain your information as follows:

• Medical records: As required by Illinois state law (minimum 7 years)
• Payment information: As required for tax and billing purposes
• Voice dictation and AI scribe audio: Not kept by TeleTonicMD; discarded once it has been transcribed
• AI scribe transcripts and drafts: Deleted automatically 30 days after the most recent draft is created, or 24 hours after the scribe starts if no draft is created; text your physician moves into a signed note is kept with your medical record
• Records of your consent choices: Kept with our security audit records for at least six years, as HIPAA requires
• Website usage data: Typically 24 months or less
• Account information: Until you request deletion (subject to legal requirements)

Deleting your patient portal account does not delete your clinical records, which are retained as required by applicable law.

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, services, applicable laws, or technology improvements. We will notify you of material changes by posting updates on our website, sending email notifications to registered users, or providing notice during your next consultation.

Acknowledgment

By using our services or website, you acknowledge that you have read, understood, and agree to this Privacy Policy. If you do not agree with these terms, please do not use our services or provide us with any personal information.