Privacy Policy
At Berries Health Inc. and its affiliated companies ("Berries", "we," "us," or "our"), your privacy matters to us. This Privacy Policy outlines how we collect, use, disclose, and protect your personal information when you interact with our platform, including our website, mobile application, and related services (collectively, the “Services”). It also reflects our commitment to privacy, as outlined in our Security Page. By using our services, you agree to the practices described herein. Where applicable, users are responsible for ensuring that they have obtained all necessary consents and legal permissions to upload and process personal and health-related data through the Services.
1. User Classification and Agreement to Terms
This Privacy Policy applies to:
Visitors: Individuals browsing our publicly available website.
Customers: Registered users of the Berries platform.
Authorized Users: Individuals authorized by Customers to use our platform.
Patient Users: patients and their personal representatives who use the patient portal or receive communications through the Services.
By accessing our website or platform, you agree to the terms outlined in this Privacy Policy.
1A. Our Role With Patient Information
Berries provides its Services to healthcare providers. When we process information about a provider's patients, including through Berries EMR and the patient portal (“Patient Information”), we do so on behalf of the provider, as its business associate under HIPAA or its service provider or processor under other laws. The provider's Notice of Privacy Practices, our Business Associate Agreement with the provider and applicable law govern Patient Information, and this Privacy Policy does not reduce those protections. Patients should direct requests to access, correct or delete their information to their provider. We forward requests we receive directly to the provider.
1B. Berries EMR and the Patient Portal
Information from Patient Users. When a Patient User uses the patient portal, we collect login credentials, contact details, device and log information, and the information the Patient User submits, such as forms, messages, signatures and payment details. We use it to provide the portal on the provider's behalf, to secure accounts and to meet legal obligations.
No advertising technology. We do not use advertising, remarketing or similar tracking technologies, or share information with advertising partners, in the Berries application, the patient portal, or pages where patients book appointments, complete forms or make payments. The marketing tools described in Sections 4 and 10 apply only to our public website.
Payment information. Card and bank details are collected and processed by our payment processor, Stripe, and are not stored by Berries.
Text messages. We use mobile numbers only to send the messages the user or the provider requested. We do not share mobile numbers or text-message opt-in data with third parties or affiliates for marketing or promotional purposes.
Google data. Berries' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
2. Notice at Collection of Personal Information
Under applicable US privacy laws, such as the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), relevant individuals have the right to know what personal information we collect at the time of collection.
Categories of Personal Information Collected:
Identifiers: Name, email address, IP address, date of birth (DOB), Social Security Number (SSN), and insurance details.
Sensitive Information: Health data processed for generating session notes, medical history, and insurance identifiers.
Internet Activity: Device information, cookies, and browsing patterns.
Patient Information, including the Social Security Numbers, insurance details and health information listed above, is processed on behalf of providers. Protected health information governed by HIPAA and medical information governed by California's Confidentiality of Medical Information Act are exempt from the CCPA, and the CCPA rights described in this Policy do not apply to that information.
Purposes for Collection:
To provide and improve our services.
To analyze platform usage and trends.
To comply with legal obligations.
We do not sell personal information or share it for cross-context behavioral advertising.
3. HIPAA Compliance
Berries meets the relevant requirements under the Health Insurance Portability and Accountability Act (HIPAA). We process Protected Health Information (PHI) under strict security measures:
Encryption: PHI is encrypted during storage and transmission.
Access Control: Access to PHI is restricted to authorized users.
Administrative, Technical, and Physical Safeguards: We implement safeguards designed to protect PHI in accordance with HIPAA Security Rule requirements.
For clarity, PHI includes insurance details, Social Security Numbers, related patient identifiers, session transcripts, clinical notes, diagnosis codes, treatment plans, billing-related documentation, and other health-related content processed through our Services.
We do not store audio recordings of sessions. Audio data is processed for the purpose of generating transcripts and related outputs and is not retained following processing, except as required for technical troubleshooting or legal compliance.
For HIPAA-related inquiries, email help@heyberries.com.
4. How We Use Personal Data
Service Delivery: To provide, improve, and support our platform.
Documentation: To analyze session content and generate or suggest documentation elements, including potential diagnosis codes, treatment plans, patient instructions, post-session letters, insurance-support documentation, treatment-related classifications, billing codes, and claim-related information.
Pre-Session and Contextual Features: To generate summaries or highlights of prior sessions to assist providers in preparing for upcoming sessions.
AI Chat Assistant: To provide an AI-based chat assistant that may access relevant prior session context to respond to user inquiries, generate clinical or administrative support content, and assist with documentation-related questions. The AI Chat Assistant may analyze content from prior sessions and related documentation to generate contextual responses. The assistant is designed as a support tool for authorized healthcare professionals and does not replace independent clinical judgment. All clinical, diagnostic, treatment, and billing decisions remain solely the responsibility of the healthcare provider. For clarity, the AI Chat Assistant may access session transcripts, notes, and related documentation to generate contextual responses. This processing occurs in real time and is limited to supporting authorized users in documentation and workflow tasks.
Analytics: To understand user behavior and enhance functionality.
Business Transfers: In corporate transactions, with appropriate safeguards.
Legal Compliance: To meet legal obligations and respond to claims.
We use artificial intelligence technologies to analyze session data and generate outputs. These systems may process session transcripts, notes, and related documentation. We do not use identifiable Protected Health Information to train generalized AI models unless explicitly permitted and in compliance with applicable law. Where data is used for improvement purposes, it is de-identified or aggregated.
Where data is used for analytics or service improvement, it is processed in de-identified or aggregated form in accordance with applicable legal standards.
Our use of Google marketing services and features - including the Google Display Network, YouTube Ads, Google Ads, the Google Ads Enhanced Conversions feature, and Google Remarketing - is subject to Google’s relevant policies and agreements, and users have the option to opt out via the relevant web pages. You can read more about Google’s terms and privacy practices at https://policies.google.com/. We also use analytics tools such as Google Analytics and Google Analytics 4 (GA4) to improve our website and services. For more information about how Google collects and processes data, visit https://policies.google.com/technologies/partner-sites and https://policies.google.com/privacy?hl=en-US. You can opt out of Google Analytics Advertising Features at https://optout.networkadvertising.org/?c=1 and https://tools.google.com/dlpage/gaoptout.
Meta
Our use of Facebook marketing services and features is subject to Facebook’s relevant policies and agreements, including Facebook’s Data Policy (www.facebook.com/policy.php?ref=pf), and users have the option to opt out via the relevant Help Center page (www.facebook.com/help/568137493302217). We also use Instagram marketing services, and their privacy policies and related information are available at https://help.instagram.com/search/?helpref=search&query=privacy%20policy and https://help.instagram.com/155833707900388.
Our use of LinkedIn marketing services and features – including LinkedIn Ads – is subject to LinkedIn’s relevant policies and agreements. LinkedIn may collect or receive information from our website and use it to provide measurement services and ad targeting. Users can learn more about LinkedIn’s data practices at https://www.linkedin.com/legal/privacy-policy and manage their ad preferences or opt out via https://www.linkedin.com/help/lms/answer/a427551 and https://www.linkedin.com/help/lms/answer/a420552.
5. What Personal Data We Collect
We collect the following types of personal data to provide our services effectively:
Account Information: Contact details for account creation.
Health Information: Session transcripts (based on recordings), medical notes, treatment plans, diagnosis codes, billing-related documentation, insurance-support materials, pre-session summaries, patient instructions, post-session letters, and related clinical content processed to generate documentation outputs. This information is accessible only to authorized users. In addition, relevant patients’ information such as name, date of birth, insurance details, Social Security Number, and other identifiers as provided by our users in connection with services. AI Assistant: by default, transcripts and draft notes are deleted after 30 days unless the user changes the retention settings. Berries EMR: records are retained for the retention period set out in our Terms of Use, unless the provider instructs earlier deletion where permitted by law. Team accounts: if you use Berries as part of a team account, your account administrator can access your notes. Your administrator can access your transcripts only if you opt in, and you may withdraw your opt-in at any time in your account settings.
Audio Data: Audio recordings are processed transiently and are not retained after processing, except where required for limited technical troubleshooting or legal obligations.
Activity Data: User interactions within the platform (e.g., tags, bookmarks).
Location Data: When you share your location.
Analytics Data: Usage patterns collected via cookies.
Feedback: Emails and communications you send us.
De-identified Data: Aggregated data for research and improvement purposes.
Categories of Personal Information Collected in the Last 12 Months:
Identifiers: Name, date of birth, email address, IP address, Social Security Number, insurance details, and account login details.
Sensitive Personal Information: Health data for session notes and transcripts.
Internet Activity: Device information, cookies, and browsing activity on our platform.
Commercial Information: Records of purchases or services requested.
Geolocation Data: Location data shared with consent.
Audio Data: Audio recordings processed into transcripts.
Inferences: Preferences derived from usage data.
Categories of Personal Information Disclosed in the Last 12 Months:
We disclosed the above categories of information to service providers, business partners, and authorized users for business purposes.
Categories of Personal Information Sold or Shared in the Last 12 Months:
We do not sell personal information or share it for cross-context behavioral advertising.
Your Rights Under the CCPA/CPRA
Patient Information, including the Social Security Numbers, insurance details and health information listed above, is processed on behalf of providers. Protected health information governed by HIPAA and medical information governed by California's Confidentiality of Medical Information Act are exempt from the CCPA, and the CCPA rights described in this Policy do not apply to that information.
California residents have the right to:
Request access to the specific pieces of personal information collected about them in the last 12 months.
Request information about the categories of personal information collected, disclosed, or sold.
Request the deletion of personal information, subject to legal exceptions.
Opt-out of the sale or sharing of personal information.
Limit the use of sensitive personal information.
To exercise your rights, email help@heyberries.com.
Nevada Residents
Nevada residents may opt-out of the sale of personal information. While we do not sell personal data, you can submit a request via help@heyberries.com.
Virginia, Colorado, and Connecticut Residents
Residents of Virginia, Colorado, and Connecticut have similar rights to California residents, including the right to:
Access personal information.
Correct inaccuracies in personal information.
Delete personal information, subject to legal exceptions.
Opt-out of processing for targeted advertising or sales.
To exercise your rights, email help@heyberries.com.
General State Privacy Rights
As privacy laws evolve, residents of other states may also have additional rights regarding their personal information. To learn more or exercise your rights, email help@heyberries.com, and we will respond in accordance with applicable laws.
6. How Do We Secure Personal Data?
We implement industry-standard measures to safeguard personal data related to you:
Encryption: Personal data is encrypted during transmission and storage.
Access Control: Access is restricted to authorized personnel only.
Regular Security Audits: Systems are routinely assessed for vulnerabilities.
Secure Mobile Application Controls: Our mobile application implements authentication and security measures designed to protect personal data accessed via mobile devices.
If a breach affects Patient Information, we will notify the affected provider as required by law and our agreement with the provider. For other personal data, we will notify affected individuals as required by law.
7. Do We Transfer Personal Data Outside Your Territory?
Yes, we may transfer personal data related to you to countries outside your jurisdiction to operate and provide services and comply with legal obligations. This may include processing by third-party service providers located outside your jurisdiction, including AI and cloud infrastructure providers.
Our hosting servers are in the United States.
Where required by law, we ensure such transfers comply with legal frameworks and maintain appropriate safeguards.
Patient Information stored in Berries EMR, including backups, is stored in the United States.
8. For How Long Do We Retain Personal Data?
We retain personal data for as long as necessary to:
Fulfill the purposes described in this Privacy Policy.
Comply with legal obligations.
We implement role-based access controls and audit logging where applicable to monitor access to sensitive data.
When personal data is no longer needed, we securely delete or anonymize it.
9. With Whom Do We Share Personal Data?
We share personal data with:
Service Providers: For technical infrastructure, hosting, analytics, and AI processing services.
Authorized Users: Healthcare professionals accessing session notes.
Service Providers: To support operations and service delivery.
Government Authorities: As required by law.
We do not sell personal data.
10. Cookies and Tracking Technologies
This Section applies to our public website. We use cookies to enhance your experience and analyze usage patterns. Cookies allow us to:
Recognize your browser or device.
Provide personalized features and content.
Track site usage to improve functionality.
You can manage cookie preferences through browser settings (and, in our website, through our cookie tool as well), but some features may not work if cookies are disabled.
In addition, when you visit our website, cookies and similar technologies may be used by our online data partners or service providers to associate your activity with other personal information they (or others) may have about you - such as your email address or online profiles. We (or our service providers) may then use this information to send marketing communications to those emails or profiles. You may opt out of this type of advertising by visiting: https://app.retention.com/optout.
11. Protection of Minors
Our Services for providers are intended for users aged 18 or older. Providers may use the Services to maintain records of patients who are minors, and a minor patient or the minor's parent or guardian may use the patient portal as permitted by the provider and applicable law. Children under 13 may not create their own portal account. Patient Information about minors is handled as described in Section 1A.
12. Privacy Policy Changes
We may update this Privacy Policy periodically. Changes will be posted on our website, and continued use of services signifies acceptance of the revised terms.
Contact Us
For questions or concerns, email us at help@heyberries.com.