Privacy Policy
This Privacy Policy explains how Harmonide (“Harmonide,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information through harmonide.com, our communications, and our healthcare-navigation services.
This policy applies to Harmonide's nonclinical navigation and advocacy activities. A separately engaged physician or medical practice maintains its own privacy notices, consent documents, and clinical records. Do not assume that information provided to Harmonide has also been provided to a physician, or vice versa.
Important health-privacy notice
Health information is sensitive. HIPAA applies only to covered entities and business associates as defined by law; it does not automatically apply to every organization that receives health-related information. Harmonide will not represent that all information it receives is protected by HIPAA unless and to the extent that a specific activity is legally subject to HIPAA.
Regardless of HIPAA status, Harmonide treats health-related information as sensitive, limits its use to stated purposes, and applies administrative, technical, and physical safeguards appropriate to the information and service.
For additional disclosures and rights concerning consumer health data, see our Consumer Health Data Privacy Notice.
Information we collect
Depending on how a person interacts with Harmonide, we may collect:
Contact and identity information
Name, email address, telephone number, mailing address, preferred language, relationship to the person receiving care, and communication preferences.
Intake and service information
A high-level description of the situation, requested services, priorities, location, timing, and information needed to determine whether Harmonide can assist.
Consumer health data
If a person chooses to provide it through an approved channel, this may include diagnoses, symptoms, medications, test information, treatment history, providers, appointments, medical records, family medical information, insurance information, billing information, care preferences, and other information related to physical or mental health or healthcare services.
Authorization and representative information
Information used to document authority to act for another person, including written permissions, releases, guardianship or proxy information, and authorized-recipient instructions. Harmonide does not ask clients to share another person's portal password.
Transaction information
Service selected, written scope, fees, invoices, payment status, and limited payment-related information. Payment-card information is processed by the selected payment processor and is not stored by Harmonide except as needed for receipts or transaction records.
Website and technical information
IP address, browser and device information, pages viewed, referral URL, approximate location derived from an IP address, security logs, timestamps, and cookie or similar-technology information. The current site is hosted by Netlify and uses Google Fonts; those providers may receive technical information needed to deliver their services. If you choose a translation language from the site's language selector, Google Translate runs in your browser and may receive page content and technical information in order to translate it. This section will be updated before any analytics, advertising pixels, session replay, or other tracking tools are added.
Harmonide Guide information
Selections and text entered into the Harmonide Guide, along with associated timestamps and routing information. The current Guide uses predefined logic and does not send conversations to an external AI model. If an external AI model is later activated, this policy will be updated before activation to identify the processing purpose, categories of provider, retention approach, human-review design, and applicable choices.
Sources of information
We may receive personal information directly from the client or prospective client; from a family member or authorized representative; from clinicians, facilities, health plans, laboratories, pharmacies, record services, and other parties authorized by the individual or permitted by law; from public professional and facility sources; from service providers that support our operations; and automatically through use of the website.
How we use information
We may use information to:
- respond to inquiries and schedule a fit call;
- determine whether a requested service is within Harmonide's scope and availability;
- provide agreed navigation and advocacy services;
- organize records and create timelines;
- coordinate appointments, communications, records requests, insurance follow-up, billing support, and travel logistics as authorized;
- communicate with the client, authorized family members, clinicians, facilities, health plans, and service providers;
- document actions, decisions, disclosures, authorizations, and client choices;
- process payments and maintain business records;
- operate, secure, troubleshoot, and improve our services;
- prevent fraud, misuse, and security incidents;
- comply with law, professional obligations, court orders, and valid legal process; and
- establish, exercise, or defend legal rights.
We do not use consumer health data for targeted advertising, data-broker activity, or individualized pricing based on predicted willingness to pay. We do not sell consumer health data.
How we disclose information
We may disclose information only as reasonably necessary for the purposes described in this policy:
At the client's direction or with authorization
To clinicians, facilities, health plans, laboratories, pharmacies, family members, translators, travel services, and other recipients the client authorizes or asks us to contact.
To operational service providers
To vendors that provide hosting, secure case management, records transfer, communications, scheduling, payment processing, document management, security, and professional support. These providers may use information only to perform contracted services and must be subject to appropriate confidentiality, data-protection, and security terms.
Current public-site provider categories include website hosting and form processing through Netlify, web-font delivery through Google Fonts, and optional in-browser page translation through Google Translate when a user selects a language.
To a separate physician practice
Harmonide does not automatically send a person's information to a related or independent physician practice. Information is disclosed for a physician consultation only when the person requests or affirmatively chooses that separate service, any required authorization or consent is completed, and the applicable legal and licensing requirements have been reviewed. The physician practice is responsible for its own clinical record and privacy notice.
For safety and legal reasons
We may disclose information if we reasonably believe disclosure is necessary to comply with law or valid legal process; protect a person from serious harm; protect the rights, safety, or security of Harmonide, our clients, or others; investigate fraud or misuse; or respond to a security incident.
Business transfer
Information may be transferred as part of a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to applicable law and continued protection of the information.
What we do not do
Harmonide does not sell personal information or consumer health data. Harmonide does not share consumer health data for cross-context behavioral advertising. Harmonide does not permit public-Guide health data to be used to train general-purpose AI models. Harmonide does not provide medical records to a related physician practice merely because the relationship exists. Harmonide does not ask a client to share a healthcare-portal password; access must use a lawful proxy, delegate, release, or other authorized method.
Public forms and email
Public website forms and ordinary email are for initial, high-level contact only. Do not use them to send medical records, medical images, dates of birth, Social Security numbers, insurance-member numbers, medical-record numbers, account numbers, payment-card information, or detailed medical histories. If Harmonide accepts an engagement, we will provide an approved method for sensitive information and records.
Cookies and tracking
Harmonide may use cookies or similar technologies that are strictly necessary for website operation, security, preferences, and form functionality. Harmonide does not currently use advertising pixels or cross-site behavioral advertising on the public website.
Before adding analytics, session replay, advertising, or social-media pixels, Harmonide will perform a privacy and health-data review, update this policy, configure consent where required, and ensure that sensitive page content, form entries, Guide inputs, URLs, and health-related events are not impermissibly disclosed.
Data retention
We retain information only for as long as reasonably necessary for the purpose collected, the written service agreement, legal and insurance requirements, dispute resolution, and security. A written retention schedule — covering unconverted inquiries, Guide and form submissions, active and completed client files, authorizations and releases, billing records, security logs, and deletion from backups — will be adopted and reflected in this policy before the site opens to the public.
Security
We use reasonable administrative, technical, and physical safeguards designed for the nature of the information, including role-based access, authentication, secure transmission and storage where appropriate, workforce confidentiality, vendor review, incident response, and minimum-necessary access. No system is completely secure, and we cannot guarantee absolute security.
Individual choices and rights
Subject to applicable law and appropriate identity verification, a person may ask to access, correct, delete, or obtain a copy of personal information; withdraw consent for future processing; change communication preferences; or receive information about certain disclosures. A request may be submitted to privacy@harmonide.com. We may request information reasonably necessary to verify identity or authority. An authorized agent may submit a request where permitted by law.
We will not unlawfully discriminate against a person for exercising a privacy right. If a request is denied, the response will explain any available appeal process and how to contact the appropriate regulator where required.
The separate Consumer Health Data Privacy Notice describes additional rights concerning consumer health data.
Children
The public website and Guide are intended for adults. We do not knowingly collect personal information directly from a child under 13 through the public website. A parent or legal guardian may contact Harmonide regarding a child's care and must have appropriate authority. If we learn that a child submitted personal information directly without appropriate authorization, contact privacy@harmonide.com so we can review and delete it as required.
International users and data transfers
Harmonide is based in the United States. Information may be processed and stored in the United States and other locations where approved service providers operate. Privacy laws in those locations may differ from those in the user's country. International services may require additional consent, transfer terms, or local-law review before records are accepted.
Harmonide does not currently market its services into the European Economic Area, United Kingdom, or Switzerland. Additional cross-border privacy review, notices, contracts, and rights processes would precede any such offering.
Changes to this policy
We may update this policy as our services, systems, and legal obligations change. We will post the revised policy with a new “Last updated” date and provide any additional notice or consent required by law before materially expanding the categories or purposes of consumer health data processing.
Contact us
Privacy questions and requests may be sent to privacy@harmonide.com, Attn: Privacy. A mailing address will be published when Harmonide's legal entity is finalized.