Privacy Policy & Data Principles
Last Updated: September 15, 2026 • Policy Version 2.4.0
Core Privacy Commitments to Healthcare Professionals
- Zero Third-Party Trackers: No advertising pixels, tracking cookies, or broker sales.
- Local-First Architecture: Briefcases and checklists store on your device by default.
- No PHI or Patient Data: We never collect, store, or transmit patient medical records.
- Transparent Cloud Sync: Cloud synchronization is opt-in and stateless.
1. Information We Collect
HealthPolicyPulse is designed specifically for physicians, practice administrators, clinicians, and health policy advocates. To deliver relevant multi-tier legislative feeds, we process minimal operational preferences:
- Practice Jurisdiction: State and county selections to filter legislative measures and public health directives.
- Clinical Specialty: Medical specialty (e.g., Primary Care, Cardiology) used solely to rank relevant fee conversion and scope statutes.
- Briefcase & Checklist State: Bookmarked bills and compliance task completion markers.
- Contact Credentials (Optional): If you choose to sign in with email or Apple ID, we store your email identifier to sync your briefcase across desktop and iOS devices.
2. Explicit Notice Regarding Protected Health Information (PHI)
HealthPolicyPulse is a public policy intelligence and legislative tracking platform. Under no circumstances should users enter, submit, or upload Protected Health Information (PHI) or individualized patient medical records into HealthPolicyPulse. Our platform does not process medical billing claims, electronic medical record chart notes, or patient identifiers.
3. Data Practices & Local-First Processing
By default, all briefcase bookmarks and compliance checklist items reside strictly in your browser's local sandbox (`localStorage`) or iOS on-device SwiftData store. If you invoke Cloud Sync or sign in, data is transmitted over TLS 1.3 to our Google Cloud Run and Google Cloud Firestore infrastructure located in `us-central1`. No data is sold, rented, or repurposed for commercial advertising.
Zero Protected Health Information (PHI) & HIPAA Exemption
HealthPolicyPulse complies with strict healthcare data privacy standards by design. We do not solicit, collect, store, or process Protected Health Information (PHI) as defined under the Health Insurance Portability and Accountability Act (HIPAA) (45 CFR § 160.103). The platform operates exclusively on public legislative dockets, administrative agency notices, and voluntary clinician profile preferences (practice state, specialty, and role).
Constituent Advocacy & Communications
Constituent Advocacy & Communications: HealthPolicyPulse does not operate an intermediate email proxy on the web platform. Advocacy drafts and representative links are processed client-side in your browser. We never capture, index, or sell political affiliations, outreach history, or lawmaker correspondence.
When utilizing the Advocacy Action Center to generate constituent briefs for elected representatives, email templates and phone scripts are compiled client-side. When you click to send an email or open a legislative portal, communications are submitted directly through your own email client or official government portal. For hardware-level Apple Private Relay inbox masking, take action via the HealthPolicyPulse iOS app.
4. Your Privacy Rights (CCPA, CPRA, State Disclosures)
You retain absolute ownership of your data. You may export your briefcase records, reset your profile at any time, or request complete deletion of any cloud-synced account by contacting privacy@healthpolicypulse.io.
5. Statutory Regulatory Notice & LegiScan CC BY 4.0 Attribution
HealthPolicyPulse provides legislative and regulatory intelligence for informational purposes only. Clinicians and healthcare administrators should verify statutory language against primary government dockets and consult legal counsel before executing operational compliance alterations. Legislative data provided by LegiScan under CC BY 4.0.