Lockbox AI Privacy Policy

Effective date: January 1, 2024

Lockbox AI, Inc. ("Lockbox," "we," "us") builds an operating platform for revenue cycle management (RCM) companies and healthcare providers. This Privacy Policy explains how we collect, use and protect personal information through lockboxai.com, portal.lockboxai.com, the Lockbox browser extension and our business communications (the "Site").

1. Customer data and protected health information

When RCM companies and providers use the Lockbox platform, we process data on their behalf, including protected health information ("PHI") from their clients' EMRs, practice management systems, clearinghouses and payer portals. For that data, Lockbox acts as a service provider and a HIPAA business associate. Our handling of it is governed by our customer agreements and Business Associate Agreements, not by this policy. We use it only to deliver the services our customers direct, and we do not sell it.

If you are a patient and want to access, correct or ask about your health or billing information, please contact your healthcare provider. We will refer any request we receive to the appropriate customer.

2. Information we collect

Information you give us

Walkthrough and contact requests: work email, name, company, systems in use, client count or staff size, and the operating challenges you describe
Business contact details exchanged at events, by email or in sales conversations
Portal account details: name, work email, role, organization and login credentials
Support requests and feedback

Information collected automatically

Device and usage data: IP address, browser type, pages viewed, referring page and time on site
Cookies and similar technologies (see section 6)
Portal and extension security logs: sign-ins, actions taken and errors, used to secure and operate the service

Information from others

Your employer or organization, when it sets up your portal account
Business contact and company information from public sources or professional networks

Please do not submit PHI through our public website forms.

3. How we use information

Respond to walkthrough requests, schedule meetings and tailor demonstrations to your systems
Provide, secure, maintain and support the portal and extension
Send business communications about Lockbox; you can opt out at any time
Understand and improve how the Site performs
Detect, prevent and investigate fraud, abuse and security incidents
Meet legal obligations and enforce our agreements

4. Third-party system credentials

The Lockbox platform works as an overlay on systems our customers already use. Customers provide us credentials to those systems. We encrypt these credentials in transit and at rest, restrict access to authorized personnel and automated processes, and use them only to retrieve information and write back notes and actions as the customer directs. We never sell, share or reuse them for any other purpose.

5. Artificial intelligence

The platform uses automation and AI models to prioritize work, organize information and, where offered, support documentation review and coding. We use AI providers under agreements that protect customer data and, where PHI is involved, under business associate terms. We do not allow customer data to be used to train third-party foundation models.

6. Cookies and analytics

Our public website uses cookies and similar tools to keep the site working and to measure traffic. We use Ploy's built-in, first-party analytics to measure aggregate traffic and site usage. It sets a cookie named ploy_anon_id that lasts up to one year, or, if you decline analytics cookies, a cookie named ploy_consent that lasts 180 days and only records that choice. We do not use advertising or tracking pixels on the portal or any page that requires sign-in. You can control cookies through your browser settings, and where required we offer a cookie settings link. We do not currently respond to browser "Do Not Track" signals, but we honor Global Privacy Control signals as an opt-out where the law requires.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share it only:

With service providers that host, secure, analyze or support our services under contracts limiting their use of it, including cloud hosting (Amazon Web Services), email, scheduling and CRM tools
With your organization, for portal accounts it administers
For legal reasons, to comply with law, legal process or to protect rights, safety and security
In a business transaction, such as a merger, financing, acquisition or sale of assets, subject to this policy's protections
With your consent or at your direction

8. Lockbox browser extension

The Lockbox browser extension exists for one purpose: to let authorized Lockbox users view and complete their Lockbox work items while working in their organization's billing and payer systems. It accesses only the page data needed for that purpose on the sites it is configured for, and it transmits that data only to Lockbox's secured platform. It does not collect general browsing history.

The use of information received through the extension will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. We do not sell extension data, use it for advertising, or use it to determine creditworthiness, and people read it only as needed for security, legal compliance or support you request.

9. Data security

We use administrative, technical and physical safeguards designed to protect information, including encryption in transit and at rest, role-based access controls, multi-factor authentication for administrative access, logging and monitoring, and HIPAA Security Rule safeguards for PHI. No system is perfectly secure, and we cannot guarantee absolute security.

10. Retention

We keep personal information only as long as needed for the purposes in this policy, to meet legal and contractual obligations, and to resolve disputes. Customer data and PHI are retained and returned or destroyed as our customer agreements and BAAs require. Prospect information is deleted or anonymized when no longer needed for business communications.

11. Your choices and rights

Email: use the unsubscribe link in any marketing email, or email us.
Access, correction and deletion: you may ask what personal information we hold about you, and ask us to correct or delete it. Depending on where you live, you may also have rights to data portability, to opt out of certain processing, and to appeal our decision. We will honor reasonable requests regardless of your state, verify your identity first, and not discriminate against you for making one.
Portal users: some requests may need to go through your organization, which controls your account.

Send requests to legal@lockboxai.com. If we deny a request, you may appeal by replying to our response; if you are not satisfied, you may contact your state attorney general.

12. Children

The Site is for business users and is not directed to children under 18. We do not knowingly collect personal information from children.

13. International users

Lockbox operates in the United States and stores information in the United States. If you access the Site from outside the U.S., your information will be transferred to and processed in the U.S.

14. Changes

We may update this policy. We will post the updated version with a new effective date, and notify customers of material changes by email or in the portal.

15. Contact

Lockbox AI, Inc. Attn: Privacy 12468 La Grange Rd, #XXX Louisville, KY 40245 legal@lockboxai.com