We protect the health information your clinic shares with us.
We protect patient information entrusted to us and handle it under our agreements with each clinic and applicable privacy requirements.
- HIPAASecurity program
- BAABefore PHI is processed
- EncryptedIn transit & at rest
- United StatesData location
- SOC 2 Type IIUnderway
Core commitments
How we protect PHI.
Information safeguards
We use encryption and other safeguards to protect information. Patient health information is stored in the United States.
Responsible data use
We handle information to provide and support our services under clinic agreements. We do not sell patient information or use it for advertising. Additional permitted uses are described in the applicable agreements.
Controlled access
Access to patient information is limited to authorized people and protected by administrative and technical safeguards.
Your data, your clinic
Your clinic retains its rights to its information. Export, retention, and deletion are handled under the applicable agreement and law.
Our safeguards
Security and privacy controls.
HIPAA security program
Administrative, physical, and technical safeguards aligned to the HIPAA Security Rule. BAA with Ekco Health Ltd. required before patient health information is in scope.
Encryption
We use encryption and other safeguards to protect information. Electronic messages can carry risks outside our systems, including exposure on a recipient device or during delivery.
Clinic oversight
Your clinic directs communications and remains responsible for clinical judgment, content, and patient care. Authorized staff can oversee use of the service.
Clinics stay separate
We use safeguards designed to prevent unauthorized access to clinic information.
Ongoing review
We review our safeguards to address privacy and security risks.
Documentation
Additional privacy and security information is available to clinic customers on request.
Compliance detail
Agreements, consent, and complaints.
The signed agreements with your clinic govern specific service and data-handling details.
Business Associate Agreement
A Business Associate Agreement must be in place before Ekco Health processes protected health information on behalf of your clinic.
- Contact us to review the agreement and complete the appropriate paperwork before using the service with patient information.
- Security and privacy documentation is available to clinic customers on request.
Clinic obligations
Ekco Health Ltd. is your business associate. You remain the covered entity, responsible for consent, message content, and honoring STOP requests.
- Obtain and document patient consent as required by applicable federal and state law, and provide required notices about messaging.
- Ensure that patient communications are appropriate for your practice and comply with applicable privacy, consent, and care requirements.
- Honor STOP and opt-out requests promptly.
- Remain responsible for the patient relationship and clinical decisions. Ekco Health acts as a service provider to your clinic.
- Keep patient contact information accurate and notify your clinic when it changes.
SMS & TCPA
Ekco Health Ltd. is your business associate for messaging technology. Consent under the TCPA, state messaging rules, and message content remain your responsibility as the covered entity.
- Document consent before the first health-related text, written or electronic per your counsel's guidance.
- Provide the disclosures and opt-out instructions required by law and share the Messaging Terms (/sms-terms).
- Obtain the level of consent required for the communications your clinic sends.
This is operational guidance, not legal advice. Consult your counsel for TCPA and state-specific requirements.
Privacy complaints
Individuals have the right to file a privacy complaint with the U.S. Department of Health and Human Services Office for Civil Rights (OCR), and may also contact Ekco Health or their clinic, per HIPAA §164.530(d).
- File with HHS Office for Civil Rights at hhs.gov/ocr.
- Or email Ekco Health with your clinic name and a description of the concern (privacy@ekcohealth.com).
- We aim to acknowledge complaints we receive within five business days and investigate per our HIPAA Privacy Policy.
Your data
Information and your agreement.
We handle information as needed to provide services to clinics under our agreements and applicable law. Retention, deletion, and any additional permitted uses are governed by those terms.
Information that has been de-identified may be used to support service improvement where permitted by the clinic agreement and applicable law.
Patient-facing detail: Data & privacyMessaging terms
FAQ
Questions clinics ask first.
Does Ekco Health sell patient information?
How is patient information used?
What is your SOC 2 status?
When is the BAA signed?
Where does our data live?
Are patient texts encrypted end to end?
What happens to our data if we cancel?
Can we get detailed security documentation?
Need receipts?
Security questionnaires are typically turned around within five business days. Detailed documentation available on request.
contact@ekcohealth.comsecurity@ekcohealth.comprivacy@ekcohealth.com