Siggy Global Technologies LLC ("Siggy GT," "we," "us," or "our") makes Siggy, an electronic health record and practice-management platform for behavioral-health practices (the "Service"), and runs the website at siggygt.com. This policy explains what information we collect, how we use and share it, and the choices you have.
1. Who this policy covers, and our role
This policy covers information about people who visit our website, contact us, or ask for a demo, and about the practice staff who use the Service (for example their name, work email, role and sign-in activity).
Practices that use the Service (our "Customers") are healthcare providers and, in most cases, covered entities under HIPAA. When a practice stores patient information in the Service, we handle it as the practice's business associate, under a business associate agreement ("BAA") and our customer agreement. The practice decides what information it collects and how it is used. We use that information only to provide the Service to the practice and as the BAA and the law allow.
Patient information is therefore governed by the practice's own notice of privacy practices and by our BAA, not by this policy. If you are a patient and want to see, correct, or ask about your records, or change how you are contacted, please contact your practice. If you contact us, we will refer you to your practice or help the practice respond, as our agreements require.
2. Information we collect
We collect the following kinds of information:
- Website visits: like most websites, our servers record technical information such as IP address, browser type, pages requested and the time of each request, which we use to deliver and secure the site.
- Inquiries: when you use our contact form or email us, your name, organization, phone number, email address, and what you write to us.
- Customer account information: practice details, the names, work contact details and roles of staff users, billing contacts, and the records of our agreements with the practice.
- Sign-in and security information: sign-in events, two-step verification settings, IP address, browser and device type, and security events. Staff must use two-step verification to sign in.
- Usage and activity information: which features are used and how much (for example messages sent, AI drafts created, or video minutes), so that we can operate, support and bill for the Service. The Service also keeps an activity record of who viewed or changed records, which belongs to the practice.
- Support and business communications: what you tell us when you ask for help or work with our team.
- Customer data: the patient and practice information that a practice enters or creates in the Service, such as demographics, appointments, clinical documentation, insurance and billing details, messages, forms and files. We handle this only as described in Section 4.
Card and bank details for payments are entered directly into fields provided by our payment processor, Stripe. We do not store full card numbers.
3. How we use information
We use the information in Section 2 (other than customer data, which is covered in Section 4) to:
- Answer inquiries, arrange demos, prepare quotes, and set up and manage customer accounts.
- Provide, operate, secure, support and improve the Service and the website.
- Verify identity, prevent fraud and abuse, and investigate security incidents.
- Measure usage, send invoices, and collect payment for the Service.
- Send service messages such as sign-in, security, billing and product-change notices, and, where allowed, occasional business updates you can opt out of.
- Meet legal obligations, enforce our agreements, and establish, exercise or defend legal claims.
4. How customer data is handled in the Service
Because practices trust us with patient information, we hold it to stricter rules:
- We use and disclose customer data only to provide the Service to the practice, as directed by the practice, and as our customer agreement, the BAA and the law allow.
- We do not sell customer data, and we do not use it for advertising.
- We do not use customer data to train AI models. Our AI provider's terms do not allow it to use customer data to train its models.
- Customer data is stored and processed in the United States.
- As the BAA and HIPAA allow, we may create de-identified or aggregated information (for example, totals that do not identify any patient or practice) to operate, secure, support and improve the Service. We do not sell it or try to re-identify anyone.
- Our people access customer data only when needed to provide, support or secure the Service. Support access to a practice's records requires approval and is time-limited.
5. AI note drafts and visit transcription
AI note drafts. When a practice turns on AI features, a clinician can ask the Service to turn the clinician's own notes, dictation, or a visit transcript into a first draft of a clinical note. The draft is written by Anthropic's Claude models running on Google Cloud's Vertex AI, under our agreement with Google. A licensed clinician must review, edit and sign every draft before it becomes part of the record. The AI does not make diagnosis, treatment or billing decisions, and it does not communicate with patients. The Service records which notes were drafted with AI.
Visit transcription. A practice can choose to turn on transcription for one-to-one video visits. Everyone in the visit must agree, at every visit, and nothing is transcribed until they do. Anyone can stop transcription during the visit, which deletes that visit's transcript. While it is on, speech is converted to text by Google Cloud Speech-to-Text. No audio or video is kept: only the written transcript is stored. The transcript is used to draft the note, is never part of the signed note, and is deleted within 30 days. Until then, it can be read only by the practice's administrators, the visit's clinician, the patient's care-team clinicians, and their clinical supervisors. Administrators and the visit's clinician can delete it at any time.
6. Email and text messages
Practices use the Service to send patients appointment, billing, portal and other messages. These messages are sent on the practice's behalf, and the practice is responsible for their content and for having the consents the law requires.
Billing emails such as receipts, statements and payment notices are transactional and are sent even if a patient has turned off other emails. Text messages are sent only to people who have agreed to receive them, and replying STOP opts out. Message and data rates may apply. We deliver these messages through email and text-messaging providers that work for us. Any provider that handles patient information does so under a business associate agreement.
9. How long we keep information
We keep inquiry and account information for as long as needed for the purposes in this policy, including our business relationship, legal, tax and accounting obligations, and resolving disputes.
Customer data is kept for the length of the customer agreement and then returned and deleted as that agreement and the BAA provide. A practice can request a complete export of its records before its account closes. Backup copies expire on their regular schedule. Some information has shorter set periods: visit transcripts are deleted within 30 days.
10. Security
The Service is designed to support HIPAA compliance, and we sign BAAs with our Customers. Our safeguards include encryption in transit and at rest, hosting in the United States, keeping each practice's records separate, required two-step verification for staff, role-based access, and a record of who viewed or changed information.
No system is perfectly secure, and we cannot guarantee that information will never be accessed, used or lost without authorization. If a breach affects customer data, we will notify the affected practice as HIPAA and our BAA require, so that the practice can meet its own notice duties. Please keep your password and two-step verification device safe, and tell us at once at info@siggygt.com if you think your account has been misused.
11. Your choices and rights
You can choose what to send us, and you can opt out of non-essential business emails at any time using the link in the email or by writing to info@siggygt.com. Service, security and billing messages for account users cannot be turned off while an account is active.
Depending on where you live, you may have the right to ask for access to, correction of, or deletion of your personal information, or to appeal a decision about such a request. Email info@siggygt.com with the subject "Privacy request." We may need to verify your identity, and we may keep information where the law requires or allows. We will not treat you differently for using these rights. Requests about patient records go to the practice, as explained in Section 1.
12. Children
Our website and the Service's staff features are meant for adult professionals, not children. Practices may keep records about patients who are minors and may invite minors or their guardians to use the patient portal or join video visits. Those records are customer data, handled under Section 4 and the practice's own policies.
13. Changes and contact
We may update this policy as the Service, our providers, or the law change. The date at the top shows the latest version. If we make a material change, we will tell Customers by email or in the Service before it takes effect.
Questions or requests: info@siggygt.com, or write to Siggy Global Technologies LLC, 681 Harleysville Pike, Harleysville, PA 19438. Please do not send patient information or passwords by email.