Privacy Policy

01Overview

Penna ("Penna," "we," "us") retrieves medical records and prepares source-cited medical chronologies for firms and providers. This policy explains what information we handle, how we use and protect it, and the choices you have. It covers our website at pennarecords.com and the services we provide under a signed agreement. It does not change any term of a Business Associate Agreement or services agreement between us; where those agreements say something different, they control.

02Website information and protected health information

We handle two very different kinds of information, and we treat them differently.

• Website and account information is what you share when you browse the site, ask for a sample, or manage your account. This policy governs that information.
• Protected health information (PHI) is the medical and billing content inside the case materials you send us. We handle PHI only as a business associate, under a signed Business Associate Agreement, and that agreement, not this policy, sets the rules for it. Section 06 explains how that works.

03Information we collect

Information you give us

• Contact and account details, such as your name, firm or organization, email address, and phone number.
• Case materials you send us, which may include medical records, billing records, and signed authorizations. These often contain protected health information.
• Messages, questions, and support requests.

Information collected automatically

• Basic, aggregated usage data, such as which pages are viewed and general device and browser information, gathered through cookieless analytics.

We do not run advertising trackers, and we do not sell or rent information to anyone.

04Cookies and tracking

Our marketing site is built to work without tracking cookies. We use cookieless analytics that count visits without identifying you or following you across other sites, so there is no tracking-cookie banner to click through. Signing in to a client account uses a strictly necessary session cookie to keep you logged in; it is never used for advertising.

05How we use information

• To retrieve, organize, and summarize records and deliver the chronologies you request.
• To communicate with you about your account, your cases, and support requests.
• To operate, secure, and improve the service.
• To meet our legal, regulatory, and contractual obligations.

We use protected health information only to perform the services set out in the Business Associate Agreement, and for no other purpose.

06HIPAA and Business Associate Agreements

When we handle protected health information for a client, we act as a business associate under HIPAA. A signed Business Associate Agreement is in place before any protected health information moves. That agreement governs how we may use, disclose, safeguard, and dispose of protected health information, including our duties if a breach ever occurs, and it controls if anything in this policy appears to conflict with it.

07How we share information

We do not sell information, and we share it only as far as the work requires:

• With service providers who help us run the business, such as secure hosting, email, and payment processing, under confidentiality and data-protection terms and, where they handle protected health information, a Business Associate Agreement.
• With the client who engaged us, as part of delivering the work.
• When the law requires it, or to protect the rights, safety, and integrity of the service.

Information is handled and stored in the United States.

08How we protect information

• Encryption of data in transit and at rest.
• Access limited to the people who need it to do the work.
• Audit logging of access to case materials.
• Administrative, physical, and technical safeguards matched to the sensitivity of the information.

No system is perfectly secure, but we work to protect information using safeguards consistent with our obligations, and we hold our service providers to the same standard. The specific safeguards will be confirmed before launch.

09How long we keep information

We keep information for as long as we need it to provide the service and to meet our legal and contractual obligations, then delete or de-identify it. Handling and disposal of protected health information follow the applicable Business Associate Agreement. Specific retention periods will be confirmed before launch.

10Your privacy choices and rights

Depending on where you live and your role, you may have the right to access, correct, or delete certain information, or to object to some uses. Because we do not sell information or use it for targeted advertising, there is nothing to opt out of on that front. Requests that involve protected health information run through the client and the applicable Business Associate Agreement. To make a request, contact us using the details in section 13, and we will respond as the law requires.

11Children's privacy

Penna is a service for firms and providers, not for the general public, and our site is not directed to children. We do not knowingly collect information from children through the website. Medical records we handle for a case may relate to a person of any age, including a minor; that information is protected health information and is governed by the Business Associate Agreement, not by this section.

12Changes to this policy

We may update this policy as our practices or the law change. When we do, we will revise the date at the top and, where appropriate, give additional notice.

13Contact

Questions about this policy can be sent to [email protected], or through our contact page.