HealixAI Logo

Privacy Policy & AI Disclosures

Effective Date: April 1, 2026•Last Updated: October 2026 (VA Lighthouse Certified & CARIN Code of Conduct)
HEALIXAIHIPAACOMPLIANT

HIPAA, CMS & VA Lighthouse Compliant Platform

HealixAI complies with strict healthcare privacy regulations, VA Lighthouse data covenants, federal HTI-1 algorithm transparency, and official Medicare API security rules to safeguard your health information.

At HealixAI, operated by Healix AI, Inc. (and affiliated entities including HealixAI, LLC), we are committed to protecting your privacy and ensuring the security of your personal health information. Created by a board-certified physician, we understand the sacred trust between patients and healthcare providers. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

1. Health Data & FHIR / Medicare Compliance

HealixAI utilizes the industry standard SMART on FHIR (Fast Healthcare Interoperability Resources) framework and official Medicare API channels to securely connect to your electronic health records and Medicare claims data. We explicitly request read-only access to the following clinical data scopes:

  • Patient Profile & Demographics (Patient.read)
  • Medications & Prescriptions (MedicationRequest.read)
  • Clinical Conditions (Condition.read)
  • Laboratory & Vitals (Observation.read)
  • Medicare Claims Data (ExplanationOfBenefit.read)
  • Immunizations (Immunization.read)
  • Allergies & Intolerances (AllergyIntolerance.read)
  • Surgical Procedures (Procedure.read)
  • Diagnostic Reports (DiagnosticReport.read)
  • Insurance Coverage (Coverage.read)
  • VA Veteran Health API (patient/*.read)
  • VA Community Care & Status (community_care.read, veteran_status.read)

We never request write access. HealixAI cannot modify, delete, or create records in your provider's electronic health record system. All FHIR and Medicare API requests are strictly read-only operations.

2. AI Architecture, Model Transparency & Data Usage

HealixAI utilizes specific Artificial Intelligence (AI) and Machine Learning (ML) engines to provide 24/7 conversational navigation and evidence-based clinical guidance. Our AI architecture includes:

Google Gemini 3.1 Live (Vertex AI)Powers live real-time WebRTC conversational voice companion and health navigation dialogue under our signed Google Cloud BAA.
BigQuery Vector SearchIndexes 2.3M+ peer-reviewed PubMed articles (`text-embedding-005`) for sub-150ms peer-reviewed clinical citations.
PyHealth ML EngineNormalizes raw ICD-10/LOINC codes to calculate 30-day readmission risk and polypharmacy safety alerts.

Data Transmitted to AI: HealixAI extracts structured clinical observations, conditions, and medication names before processing. We never send full raw FHIR bundles, Social Security Numbers (SSNs), financial details, or home addresses to AI inference models.

Zero Model Training Guarantee: Your personal health data, Medicare claims, and conversations are NEVER used to train public AI models, foundation LLMs, or third-party algorithms. Informed consent is required for all data processing.

3. Voice Streaming & Audio Privacy

"For privacy, all audio streaming happens statelessly over TLS 1.3 encrypted connections under our signed Google Cloud BAA. Our platform does not store raw voice recordings or audio transcripts on translation nodes, which keeps us fully compliant with HIPAA security rules."

4. Responsible AI Disclosure & Error Reporting

While our AI guidance is grounded in peer-reviewed PubMed science and validated clinical guidelines, AI-generated content can occasionally return unexpected outputs. If you observe any abnormal AI output:

  • Contact our AI Safety Officer immediately at ai-safety@healixai.com.
  • Reports are reviewed by medical personnel within 24 hours.
  • Medical Disclaimer: HealixAI guidance does not substitute for professional medical advice. Always consult with a qualified healthcare provider for clinical decisions.

5. Business Transfers & Corporate Reorganization

In the event of a merger, acquisition, corporate reorganization, asset sale, or bankruptcy of Healix AI, Inc.:

  • Users will be notified at least 30 calendar days prior via email and in-app notice of any ownership change.
  • If user information is transferred to an acquiring entity, the acquirer remains bound by the terms of this Privacy Policy.
  • Right to Withdraw Consent: Users maintain the absolute right to revoke consent and request immediate data deletion prior to any business transfer by contacting privacy@healixai.com.

6. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal mandates, CMS regulations, or AI tools.

Notification Procedure: For material policy changes, we will notify users 30 days in advance via email and display a prominent banner upon app launch.

Acceptance Requirement: Users may be required to review and explicitly click to accept the updated policy before continuing service access.

7. Data Retention, Dormant Accounts & Revocation Rights

You have the absolute right to revoke our access to your Electronic Health Records (EHR), VA Lighthouse data, and Medicare claims at any time directly through your provider portal, VA.gov, or Medicare.gov.

12-Month Account Dormancy Policy (VA and Non-VA Data): If an account remains dormant (no user login, conversational interaction, or active FHIR sync) for twelve (12) consecutive months (365 calendar days), HealixAI automatically, permanently, and cryptographically purges all Veteran health records, synchronized observations, and all non-VA shared health data from active storage and caches. An advance warning notice is transmitted to your registered email at eleven (11) months (30 days prior to purge).

On-Demand Deletion: Upon account closure, data is cryptographically purged within 30 calendar days. To request immediate on-demand deletion, email privacy@healixai.com. We execute and confirm data purging within 5 business days.

8. Department of Veterans Affairs (VA) Lighthouse API & Veteran Data Covenant

For all Veterans connecting their records via the VA Lighthouse Developer Platform (`developer.va.gov`), HealixAI strictly enforces the following statutory covenants:

8.1 Prohibition on Sale of Veteran Data

HealixAI explicitly confirms and warrants that no Veteran data is sold, rented, leased, licensed, or monetized for profit or other monetary transactions under any circumstances. Veteran records are used strictly to provide direct clinical visualizations, care management, and health navigation directly to the Veteran.

8.2 Security Breach Notification Protocol & Veteran Protective Actions

If there is a confirmed or suspected breach involving Veteran data, HealixAI will notify the affected Veteran directly without unreasonable delay and in no case later than forty-eight (48) hours via registered email and in-app alerts. The notice will provide comprehensive instructions regarding further protective actions the Veteran may take, including:

  • Instructions on how to revoke HealixAI's data access permissions through official VA.gov profile settings;
  • Guidance on immediate credential resets;
  • Complimentary identity theft and credit monitoring enrollment information;
  • Direct contact details for our Data Protection Officer at privacy@healixai.com and the VA Information Security Officer.
8.3 Transfer of Ownership, Sale of Business, or Corporate Dissolution

If HealixAI undergoes a change of ownership, merger, acquisition, asset sale, or ends/sells its business: (1) Veterans will receive at least thirty (30) calendar days advance written notice; (2) Veterans retain the absolute right to opt out and request immediate cryptographic deletion of all their records prior to transfer; (3) no Veteran data will be transferred unless the successor agrees to be bound by the exact same (or more stringent) non-sale, privacy, and security terms; and (4) if the company terminates without a qualifying successor, all Veteran data will be permanently destroyed per NIST SP 800-88 guidelines and will never be sold, auctioned, or liquidated as commercial assets.

8.4 Advance Notice of Policy & Terms Modifications

HealixAI will notify users, including Veterans, of any material modifications made to this Privacy Policy or the Terms of Service at least thirty (30) calendar days in advance of the effective date via direct email to registered email addresses and a prominent in-app notification banner upon login.

8.5 Data Retention & Dormancy Purging (VA and Non-VA Data Shared)

HealixAI retains health records (including Veteran records and non-VA health data shared by the user) only while the account remains active. After twelve (12) consecutive months (365 calendar days) of account dormancy, all Veteran records and non-VA shared data are automatically, permanently, and cryptographically purged, preceded by an advance warning email sent at eleven (11) months. Users can also demand immediate deletion at any time via privacy@healixai.com, executed within 5 business days.

8.6 Prohibition on Third-Party Use/Disclosure & Mandatory Vendor Binding

HealixAI clearly states and explicitly covenants that third-party use or disclosure of user information (including de-identified, anonymized, or pseudonymized data) is strictly prohibited for any reason without prior affirmative consent from the user. Furthermore, HealixAI contractually and legally requires that all third-party vendors, cloud infrastructure providers, business associates, and contractors are bound to the exact same commitments to users regarding the use, disclosure, and protection of user data.

9. HIPAA & Security Standards

  • All clinical API requests executed over TLS 1.3 encrypted connections
  • OAuth 2.0 / SMART on FHIR authorization with short-lived access tokens
  • Data encrypted at rest using AES-256 in Google Cloud infrastructure
  • Annual security risk assessments and vulnerability scanning

10. Contact Information & AI Safety Officer

Healix AI, Inc. (and HealixAI, LLC)

Chief Medical Officer & AI Safety Officer: Ricardo Hamilton, MD

Privacy Inquiries: privacy@healixai.com

AI Safety Reporting: ai-safety@healixai.com

Website: www.healixai.com