1. Scope
This Privacy Policy applies to:
- our website at basisehr.com;
- the Basis EHR web platform at v3.basisehr.com (the “Platform”); and
- the Basis EHR mobile apps — Basis EHR for Android (
com.basisehr.app) and Basis EHR for iOS (com.basisehr.mobile) (the “Apps”).
Basis EHR is a business-to-business service. We provide the Platform and Apps to healthcare organizations (“Customers”), who give accounts to their employees and contractors (“Users”). There is no public sign-up.
2. Health information & HIPAA
If you are a patient: your healthcare provider controls your records in Basis EHR. Their Notice of Privacy Practices explains how your information is used. To access, correct or ask questions about your records, contact your provider directly.
When Customers store protected health information (“PHI”) in Basis EHR, we act as their business associate under the U.S. Health Insurance Portability and Accountability Act (HIPAA). We use and disclose PHI only as permitted by our agreement and Business Associate Agreement with that Customer and by law. Where this policy conflicts with a Customer agreement or BAA regarding PHI, the agreement controls.
3. Information we collect
Account information
Name, work email, phone number, job title, role, department, location, professional credentials and license details, and your organization — usually provided by your organization's administrator, sometimes by you.
Customer content
Information Users enter or upload while providing care and running their organization, such as patient demographics, clinical documentation, assessments, medications, orders, schedules, billing and insurance data, documents, faxes and electronic signatures. This can include PHI.
Communications
When your organization uses Basis EHR communication features, we process:
- call details — phone numbers, time, duration and routing;
- the content of SMS messages, team chat messages, voicemails and faxes;
- call recordings and transcriptions, only if your organization enables them.
Device & app information
Device type and model, operating system and version, app version, push notification token and platform (Android or iOS), and whether the app is registered to receive calls.
Usage & log data
IP address, browser type, the pages and features used, request timestamps, the account that made each request, error and diagnostic information, and audit records of actions taken in the Platform.
Location
The Platform may ask for your device's location while you document a home visit, when your organization uses visit verification. You can decline in your browser or device settings. The Apps do not request your location.
Information from you as a website visitor
If you request a demo or contact us, we collect the details you provide, such as your name, organization, email and phone number.
4. Mobile apps & permissions
The Apps give Users mobile access to their organization's voice calls, SMS and team chat. They ask only for the permissions needed for those features:
| Permission | Platform | Why we need it |
|---|---|---|
| Microphone | Android, iOS | To carry your voice during calls. The microphone is used only while a call is active. |
| Notifications | Android, iOS | To alert you to incoming calls and new messages. |
| Background audio & VoIP | iOS | To keep a call connected when you switch apps or lock your phone. |
| Phone-call foreground service, full-screen intent, manage own calls | Android | To keep calls running and show the incoming-call screen when the phone is locked. |
| Nearby devices (Bluetooth connect), audio settings, vibrate | Android | To route call audio to headsets and car systems, and to ring or vibrate for calls. |
| Internet & network state | Android | To connect to Basis EHR and reconnect calls when your network changes. |
The Apps do not access your contacts, call log, location, photos or camera (other than when you choose to attach a file), and do not read other apps' data. The Apps contain no advertising, do not use advertising identifiers, and do not track you across other companies' apps or websites.
You can change permissions at any time in your device settings. Turning off microphone or notification access will stop calls from working.
5. How we use information
- To provide, operate and maintain the Platform and Apps, including routing calls, messages and notifications.
- To authenticate Users and enforce the access permissions set by each Customer.
- To provide customer support and respond to requests.
- To secure our services, detect and prevent fraud and abuse, and keep audit records.
- To troubleshoot, measure performance and improve reliability.
- To send service messages such as security alerts, updates and account notices.
- To comply with law and our contractual obligations to Customers.
We do not sell personal information or PHI, do not “share” it for cross-context behavioral advertising, and do not use Customer content for marketing.
6. AI-assisted features
Basis EHR includes features that use artificial intelligence and machine learning — for example, extracting information from referral documents, clinical-documentation and assessment decision support, risk indicators, and scheduling and operational recommendations. These features process Customer content only to provide the service to that Customer. Their outputs are suggestions for qualified professionals to review; they are not medical advice and do not replace clinical judgment.
7. How we share information
We share information only in these circumstances:
- With your organization. Customers and their authorized Users can see information in their account, according to the roles they assign.
- With service providers that process data on our behalf under contracts requiring confidentiality and security — and, where PHI is involved, Business Associate Agreements.
- At a Customer's direction, such as sending orders to physicians, submitting claims to payers or clearinghouses, or integrating with other systems they choose.
- For legal reasons — to comply with law, legal process or government requests, or to protect the rights, safety and property of patients, Users, Customers, us or others.
- In a business transfer, such as a merger or acquisition, subject to the same protections described here.
Our principal service providers are:
| Provider | Purpose |
|---|---|
| Amazon Web Services | Cloud hosting, databases, file storage, email and text notifications |
| Telnyx | Voice calls, SMS, fax, and call recording and transcription where enabled |
| Google Firebase Cloud Messaging | Delivering push notifications to Android devices |
| Apple Push Notification service | Delivering push notifications and call alerts to iOS devices |
| Google Maps Platform | Address lookup, mapping and route planning in the Platform |
| Google Forms | The demo request form on our website |
8. Website & cookies
Our marketing website does not use advertising or analytics cookies. Fonts and assets are served from our own domain. The Platform uses cookies and local storage that are strictly necessary to keep you signed in, remember your settings and secure your session. The demo request form is provided by Google, whose privacy policy applies to information you submit through it.
9. Retention
We keep Customer content for as long as the Customer's agreement is in effect and as directed by the Customer, including to meet medical-record retention laws. After an agreement ends, we return or delete Customer content as the agreement specifies. Audit logs are kept for at least six years to meet HIPAA requirements. Account information is deleted or de-identified when no longer needed, subject to legal obligations. See Account deletion for how deletion requests are handled.
10. Security
We use administrative, physical and technical safeguards designed to protect information, including:
- encryption of data in transit (TLS) and at rest;
- role-based access controls configured by each Customer;
- audit logging of access and changes to records;
- hosting in secured, access-controlled data centers; and
- workforce confidentiality obligations and least-privilege access for our personnel.
No system is completely secure. If we learn of a breach affecting your information, we will notify affected Customers and individuals as required by law and our agreements.
11. Your choices & rights
- Users: you can review and update much of your profile in the Platform. Your organization's administrator can also update or deactivate your account. To request deletion, see Account deletion.
- Patients: exercise your HIPAA rights — access, amendment, accounting of disclosures — through your healthcare provider. We will assist providers in responding.
- Device permissions: manage microphone, notification and Bluetooth access in your device settings.
- U.S. state privacy laws: depending on where you live, you may have rights to know, access, correct or delete personal information, and to appeal our decision. Information governed by HIPAA may be exempt. We will not discriminate against you for exercising your rights.
- EU/UK and India: if the GDPR, UK GDPR or India's Digital Personal Data Protection Act, 2023 applies to you, you may have rights to access, correct, erase, restrict or object to processing, and to complain to your data-protection authority. Where we process data for a Customer, we will direct your request to that Customer.
To make a request, email privacy@basisehr.com. We will verify your identity before acting and respond within the time required by applicable law.
12. Children
The website, Platform and Apps are intended for use by healthcare professionals and are not directed to children. We do not knowingly collect personal information from children for our own purposes. Information about pediatric patients is processed only on behalf of Customers as PHI.
13. International users
Basis EHR is operated from and stores Customer content in the United States. Where our personnel or service providers access information from other countries, we apply contractual, organizational and technical safeguards to protect it.
14. Changes to this policy
We may update this policy from time to time. We will post the updated version here with a new effective date and, for material changes, notify Customers or Users through the Platform or by email.
15. Contact us
BasisEHR, LLC
Privacy: privacy@basisehr.com
Support: support@basisehr.com