1. Who we are
CollaboratMD provides revenue cycle management software to medical practices and the billing companies that serve them. Our office is at 10377 S Jordan Gateway #110, South Jordan, UT 84095. Throughout this policy, we means CollaboratMD, and you means a person who visits this website or uses the platform.
When a practice uses the platform to bill for care, that practice is the covered entity and we act as its business associate under the Health Insurance Portability and Accountability Act. The practice decides what information enters the system and why. We process it on the practice's written instructions.
2. Information we collect
Information you give us
- Account details such as your name, work email address, role and practice affiliation.
- Anything you send through a contact form, a support request or a sales inquiry.
Information a practice enters
- Patient demographics, insurance coverage and guarantor details.
- Encounters, diagnosis and procedure codes, charges and claim records.
- Remittance advice, payments, adjustments, denials and appeal correspondence.
Information we collect automatically
- Log data: IP address, browser and device type, pages requested and timestamps.
- Audit records of key actions, such as sign-in, claim submission and corrections, and who took them.
- Strictly necessary cookies that keep you signed in and protect the sign-in form.
3. Why we use it
We use information for a short and specific list of purposes:
- To run the service. Verifying eligibility, scrubbing and submitting claims, posting remittances, tracking denials and producing statements.
- To keep it secure. Investigating incidents and maintaining the audit log.
- To support you. Answering questions, diagnosing problems and restoring data after an error.
- To meet legal obligations. Retention, reporting and responses to lawful requests.
- To improve the product, using aggregated figures that cannot identify a patient.
We do not sell personal information. We do not use protected health information for advertising, and we do not train machine learning models on it.
4. When we share it
Information leaves the platform in these circumstances, and no others:
- Payers and clearinghouses, to submit claims, check eligibility and receive remittance advice once a practice connects a clearinghouse, which is the purpose of the software.
- Service providers that host the application and database or deliver email, each under a written agreement that limits them to our instructions.
- Anthropic, when a practice enables AI features: denial codes and non-identifying claim context for plain-language explanations, and column headings and value types when matching an import file. Names, dates of birth, member IDs and other patient identifiers are not sent.
- A practice's own EHR and lab interfaces, which exchange patient, charge, order and result messages with systems the practice connects.
- Legal requirements, where a subpoena, court order or statute compels disclosure. Where we are permitted to tell you, we will.
- A change of control, such as a merger or acquisition, with notice before your information becomes subject to a different policy.
5. How long we keep it
Claim and remittance records are retained for the period the practice specifies, which is commonly six years to satisfy HIPAA and payer audit requirements. Audit logs follow the same schedule. Marketing contact details are kept until you ask us to remove them. When a practice ends its subscription, we return or destroy its records on the timetable in the business associate agreement.
6. How we protect it
- Encryption in transit with TLS, and encryption at rest provided by our hosting and database providers.
- Role-based access, so only billers and administrators can post, adjust or write off, and every request is checked against the practice it belongs to.
- Posted amounts are never edited: a correction is posted as a reversal.
- An audit log of key actions.
- Backups and point-in-time recovery provided by our database host.
No system is perfectly secure. If a breach affects your information, we will notify you and the relevant authorities within the timeframes the law requires.
7. Your choices and rights
You may ask us to access, correct, export or delete the personal information we hold about you, and you may object to certain processing. If your information is in a practice's records, we will refer your request to that practice, since it decides what happens to the data it controls.
Residents of California, Colorado, Connecticut, Utah, Virginia and other states with comprehensive privacy laws have specific statutory rights, including the right not to be discriminated against for exercising them. Residents of the European Economic Area and the United Kingdom should read the GDPR page, which sets out the lawful bases we rely on and how to reach our data protection contact.
8. Cookies
The platform uses strictly necessary cookies only: one session cookie that keeps you signed in, and protections against cross-site request forgery. We set no advertising cookies and run no third-party trackers, so there is no consent banner to dismiss.
9. Children
The platform is sold to healthcare organizations, not to individuals, and no one under 18 may create an account. Pediatric records may of course appear in a practice's data; they are protected health information and are handled under the practice's direction.
10. Changes to this policy
We will post any revision on this page and update the date above. For a change that materially affects your rights, we will give advance notice by email or inside the application before it takes effect.
11. Contact us
Write to our privacy team through the contact page, or by mail to CollaboratMD, 10377 S Jordan Gateway #110, South Jordan, UT 84095. We answer privacy requests within 30 days, and we will tell you if we need longer.