Privacy Policy

1 Our role and the scope of this policy

Information we handle for a practice. Health care practices and their authorized clinicians and staff (Practices) use Mahla to manage records and selected administrative and documentation tasks. When we handle protected health information (PHI) for a Practice subject to HIPAA, we act as its business associate or business associate subcontractor. We process that information under our Business Associate Agreement (BAA), the Practice’s lawful instructions, and applicable law. The BAA controls if this policy conflicts with it concerning PHI.

The Practice determines the purposes of its patient-record processing, authorizes users and recipients, and chooses the features it enables. Patient-facing communications or access occur through the Practice’s use of Mahla. A Practice’s own privacy notices explain its care-related uses and disclosures and patients’ rights. This policy is not the Practice’s HIPAA Notice of Privacy Practices, and it does not authorize us to use health information beyond the authority provided by law and our agreement with the Practice.

Information we handle for our own business. We also handle information about website visitors, prospective customers, account administrators, and people who contact us for purposes such as answering inquiries, managing accounts, collecting payment for Mahla, and securing our website. Those activities are described separately from patient-record processing below. Information about a clinician or website visitor is not automatically PHI, and information is not automatically exempt from other privacy laws because Mahla serves health care practices.

This policy does not govern a Practice’s independent activities or a third-party service’s independent processing. It does not cover employment or job-applicant information governed by a separate notice. Reading or using the Services does not replace any separate consent or authorization required by law.

2 Information we collect and its sources

We collect information directly from you, from a Practice and its authorized users, from patients or their authorized representatives using Practice-enabled features, from integrations a Practice authorizes, and automatically when the Services are used. The categories depend on the features and relationship involved.

Contact and professional information. When you request an invitation, schedule a demonstration, open an account, or contact us, we may receive your name, email address, telephone number, practice name, role, professional credentials, business address, and the content of your request. We also receive account invitations and permissions from Practice administrators and information from business referrals or publicly available practice websites.

Account and payment information. We process login and authentication information, user roles, account settings, subscription or usage information, token purchases and task charges, invoices, and payment status. Payment processors handle payment credentials needed for transactions; the information Mahla receives depends on the payment workflow. Pending confirmation: [CONFIRM PAYMENT DATA: identify whether Mahla receives full payment credentials or only limited details and processor tokens.] Payments for Mahla and patient billing performed for a Practice are different workflows; patient billing information receives the protections applicable to Practice records.

Patient and practice records. At a Practice’s direction, we may receive patient identity and contact details; demographics; appointments and waitlist status; intake and consent forms; medical and behavioral-health history; symptoms, diagnoses, medications, treatment plans, and progress notes; insurance, eligibility, claim, and billing information; and communications with the Practice. Some records may concern substance-use treatment or other sensitive care. Identifiers such as insurance or government identification numbers may be included when a Practice lawfully needs them for a selected workflow; do not submit unnecessary identifiers.

Communications and documentation inputs. Depending on the features enabled and applicable permissions, we may process emails, text messages, chat exchanges, telephone interactions, clinician dictation, session material, transcripts, and draft documents. Audio or video is collected only through an enabled feature with the notices and permissions required for that feature. We also process the Practice’s website, forms, and patient materials when it supplies or authorizes them as context for its administrative assistant. Pending confirmation: [CONFIRM RECORDING: identify which calling, session recording, transcription, and video features are actually offered; whether raw recordings are stored; and the recording notice shown to participants.]

Technical and activity information. We may collect IP address, device and browser information, timestamps, pages or features used, approximate location inferred from IP address, authentication events, error reports, and security and audit logs. Logs may include assistant actions, approvals, recipients, task outcomes, and usage charges. If this information contains PHI or identifies patient activity on behalf of a Practice, it remains subject to the applicable BAA and health privacy requirements.

Generated information. Enabled AI features may generate draft notes, treatment-plan drafts, summaries, proposed messages, scheduling responses, and administrative classifications from authorized inputs. These outputs can contain sensitive information and can be inaccurate. We handle identifiable patient outputs as Practice records and support the Practice’s review and correction processes.

You may choose not to provide optional information. Some information is needed to create an account or complete a selected task. Public invitation and contact forms are intended for business inquiries; use a Practice-approved secure channel for patient records and health information.

3 How we use information

For Practices, we process information to provide the features they choose, including storing and retrieving records; completing intake; scheduling, confirming, and rescheduling appointments; communicating about care logistics; drafting documentation; and supporting billing, eligibility, claims, or collections when those features are available and enabled. We also process information to maintain those Services, provide authorized support, prevent misuse, and meet applicable legal obligations. PHI is used only as permitted by the BAA and applicable law.

For our own business, we use contact, account, transaction, and technical information to respond to inquiries and invitation requests; administer customer relationships; process charges; send service notices; communicate about Mahla products where permitted; understand website and service performance; protect our systems; resolve disputes; and comply with law. We do not use patient health information to market Mahla or build advertising profiles.

We may derive de-identified information only when permitted by our agreement and applicable law. De-identifying PHI requires the applicable HIPAA expert-determination or safe-harbor standard, not merely deleting a name. We use properly de-identified information for internal performance analysis, security, and product evaluation. We commit to maintaining it in de-identified form, do not attempt to identify the people represented, and require the same from permitted recipients. We do not sell it, use it for advertising, or use it for model training or fine-tuning under this policy. Additional restrictions apply to specially protected records.

4 AI assistants and patient communications

Mahla’s AI assistants perform tasks a Practice enables, such as scheduling through Kali, front-desk communications through Cory, and documentation drafts through Mary. Insurance and revenue-cycle functions may be offered through other assistants. A Practice chooses the tasks it delegates and whether a supported task may run automatically or requires approval. Relevant patient and practice context may be used to carry out the selected task. Authorized Practice users can review the associated activity records.

We may use service providers to process authorized inputs and produce outputs. Providers processing PHI for us must be subject to appropriate business associate agreements and restrictions on their use of that information. We do not use patient information to train or fine-tune AI models under this policy, and we do not permit AI providers to use it to train or improve their own models or for their independent purposes. A different training arrangement would require a separate written agreement with the Practice and any legally required individual consent or authorization before it begins.

Mahla provides software and administrative assistance. Its assistants are not licensed therapists or independent health care providers. Clinicians are responsible for clinical decisions and review of clinical drafts. A generated clinical flag does not ensure that a risk has been identified or reviewed. Do not rely on Mahla as an emergency or crisis-response service; contact local emergency services when urgent help is needed.

Calls, messages, or recordings require the permissions applicable to the channel and activity. The Practice is responsible for obtaining the notices, consents, and authorizations required of it, and Mahla is responsible for its own legal duties. A request for an appointment does not automatically authorize every type of recording or promotional outreach. Follow the opt-out instructions in a message or contact the Practice to change communication preferences. Stopping a communication channel does not by itself delete the medical record or cancel an appointment. Ask the Practice for an alternative way to communicate.

5 When we disclose information

The Practice and its authorized recipients. We make Practice information available to the Practice, its authorized users, patients or representatives with appropriate access, and recipients the Practice lawfully selects. Depending on an enabled workflow, these may include other providers, insurers, clearinghouses, or payment processors. A Practice administrator may manage user access and review relevant activity within its account. An account relationship alone does not authorize disclosure of every record to every user.

Service providers. We use providers for functions such as hosting, storage, AI processing, communications delivery, security, customer support, analytics, and payment processing. They may process information only for authorized services under appropriate confidentiality and data-protection restrictions. When a provider creates, receives, maintains, or transmits PHI on our behalf, we require the applicable BAA. Health-data restrictions also apply to diagnostic logs and vendor support access containing that information. Ask us using Section 13 for information about our PHI-processing providers and their functions.

Integrations you or a Practice select. We may exchange information with a third-party service when an authorized user directs a lawful connection. A recipient acting independently may have its own privacy policy. We distinguish those recipients from vendors processing information for Mahla, and a connection does not override applicable health privacy restrictions.

Legal requirements and protection of rights. We may disclose information as required by law and, where legally permitted, to address fraud, security incidents, or legal claims. Disclosures of PHI and specially protected records must also be permitted by the BAA and applicable health privacy law. A general business interest or request from law enforcement does not itself create authority to release protected records. We apply the specific requirements for the records involved and provide notice to the Practice where legally permitted and required by our agreement.

Business transactions. Information may be transferred in a merger, financing, reorganization, acquisition, or sale of relevant assets, subject to applicable law and contractual restrictions. Identifiable health information may be disclosed or transferred only through a legally permitted pathway and with its applicable protections continuing. The possibility of a transaction does not authorize unrestricted access to patient records by a potential buyer or investor.

Your direction or permission. We may make another disclosure you or the Practice specifically requests or authorizes when legally permitted. We obtain a separate consent or authorization when required.

We do not sell personal information or share it for cross-context behavioral advertising, and we do not process personal information for targeted advertising. We do not disclose patient information for third parties’ independent marketing. These commitments apply to transfers that qualify as a sale or sharing under applicable privacy law, even when no money changes hands.

6 Cookies and similar technologies

We use cookies, local storage, or similar technologies as needed to maintain sessions, remember preferences, secure accounts, and operate the Services. We may also use limited tools to measure website performance under restrictions consistent with this policy. We do not deploy advertising pixels or third-party advertising trackers on our website or within patient or clinical workflows. Patient communications, record content, and identifiable patient activity are not provided to marketing analytics services.

Pending confirmation: [COMPLETE BEFORE PUBLICATION: list the actual analytics or other nonessential tools, providers, purposes, and retention periods, or state that none are used; identify the live cookie-preferences link if one exists. Confirm that tools do not create a sale, sharing, or targeted-advertising activity inconsistent with Section 5.]

You can use browser controls to remove or block cookies, although disabling necessary cookies may affect functionality. Where consent is required for a nonessential technology, we obtain it before use and provide a way to withdraw it. We honor legally required universal opt-out preference signals, including Global Privacy Control, for processing to which they apply. Because we do not sell or share personal information or use it for targeted advertising, there is no such activity to opt out of under this policy. Pending confirmation: [CONFIRM DO NOT TRACK: state the website’s actual response to legacy browser Do Not Track signals separately from Global Privacy Control.]

7 Retention and deletion

We retain personal information only as long as reasonably needed for the purposes described here, considering the nature and sensitivity of the information, the relationship or task, applicable law, and the need to resolve disputes or preserve evidence.

For business contact and inquiry records, we consider whether an inquiry remains open and whether there is an ongoing customer relationship or permitted communication preference. We retain account and transaction records as needed to administer the relationship and satisfy accounting, tax, and legal requirements. Technical and security logs are retained for periods appropriate to troubleshooting, security investigations, and compliance. We do not retain all categories for a single indefinite period.

For Practice records, retention, export, and deletion follow the Practice’s lawful instructions, the BAA or other applicable data agreement, and legal requirements. Practices may have medical-record retention duties that continue after a patient stops treatment. Closing a Mahla login or withdrawing consent for a particular future activity does not necessarily require deletion of records the Practice must retain.

Pending confirmation: [COMPLETE RECORDING SCHEDULE: specify retention and deletion periods for raw call or session recordings, transcripts, draft outputs, and related vendor copies. Distinguish material kept in the clinical record from temporary processing material. Do not state that recordings are immediately deleted unless that has been verified.]

At the end of a Practice relationship, we provide for return or destruction under the BAA or other applicable agreement. When retention of particular records is legally required or deletion is infeasible, we restrict their use and continue the applicable protections. Backup copies are subject to protected retention and deletion cycles. Ask the Practice about retention of its patient records, or contact us about information we hold for our own business.

8 Security and location of processing

We maintain administrative, technical, and physical safeguards designed to protect information against unauthorized access, use, disclosure, alteration, and loss. For PHI, we undertake the safeguards and other obligations in our BAA and applicable HIPAA requirements. Access is restricted according to authorized duties. No method of transmission or storage is completely secure; this statement does not limit our legal or contractual responsibilities. If an incident requires notice, we notify the responsible Practice, affected individuals, or authorities as applicable.

Mahla is intended for Practices operating in the United States. Pending confirmation: [CONFIRM PROCESSING LOCATIONS: identify hosting, backup, AI-processing, and remote-support countries, including any processing outside the United States, and revise this paragraph to describe the actual arrangement.] If information is transferred internationally, we apply the protections and transfer mechanisms required by applicable law. This policy does not treat use of the Services as blanket consent to an international transfer or a waiver of local rights.

9 Your choices and privacy rights

Requests concerning patient records. Contact the Practice responsible for your record to request access, correction, restrictions, an accounting of disclosures, or other patient rights. HIPAA does not provide a general right to erase an accurate medical record. If you send a patient-record request to Mahla, we direct it to the responsible Practice and assist as required by our agreement and applicable law. We do not use that referral to avoid duties imposed directly on us.

Requests concerning Mahla’s own records. Depending on where you live and the law that applies, you may have rights to confirm processing; obtain access and a portable copy; correct inaccuracies; request deletion; obtain information about disclosures, including recipients where required; withdraw consent; opt out of sale, sharing, targeted advertising, or certain profiling; and limit certain uses of sensitive information. Rights may be subject to exemptions and exceptions. We do not use personal information we control to make solely automated decisions producing legal or similarly significant effects under this draft policy. AI assistance selected by a Practice is subject to its responsibilities and the safeguards described above.

To make a request, contact privacy@meetmahla.com or use Pending confirmation: [PRIVACY REQUEST FORM URL OR SECOND REQUIRED REQUEST METHOD]. State your request and relationship to Mahla without sending medical records, passwords, or unnecessary identity documents. We verify identity and authority using information proportionate to the request and provide a secure method if further information is needed. An authorized agent may submit a request with evidence of authority as required by law. We respond within the period required by applicable law, notify you of a permitted extension when needed, and explain a denial and available review rights. We do not unlawfully discriminate or retaliate for exercising privacy rights.

Where applicable law gives you a right to appeal a denied request, send an appeal to privacy@meetmahla.com with the subject “Privacy appeal.” We provide a written decision and, when required, information on contacting the appropriate regulator. You may also complain to a competent privacy regulator. Patients may direct HIPAA or Part 2 concerns to their Practice and the U.S. Department of Health and Human Services Office for Civil Rights, as applicable.

Communications. You may unsubscribe from Mahla promotional emails using the message link or by contacting us. We may still send necessary account, security, and transaction notices. For messages sent on a Practice’s behalf, use the message instructions or contact that Practice. Withdrawing consent affects the processing covered by that consent and does not undo processing lawfully completed before withdrawal.

10 Additional information for California residents

This section applies where the California Consumer Privacy Act, as amended (CCPA), covers Mahla’s processing. Some information, including qualifying HIPAA-regulated information, is exempt from particular CCPA requirements. The exemption depends on the information and legal criteria; it is not a blanket exemption for all information Mahla holds.

The categories described in Section 2 include identifiers; customer-record information; commercial information; internet or network activity; professional information; audio or visual information when an enabled feature collects it; and inferences generated for the stated purposes. Sensitive information may include account-access credentials and, within Practice workflows, health information and other sensitive identifiers. Sections 2, 3, 5, and 7 describe the sources, purposes, recipient categories, and retention criteria. Pending confirmation: [VERIFY LOOKBACK: confirm which categories Mahla actually collected and disclosed for business purposes during the preceding 12 months and revise these disclosures to reflect that history, including any shorter operating history.]

We do not sell or share personal information as those terms are defined by the CCPA, including information about people we know are under 16. We do not use or disclose sensitive personal information for purposes that require offering a CCPA right to limit its use. Pending confirmation: [VERIFY THESE STATEMENTS AGAINST ACTUAL PRACTICES AND THE APPLICABLE LOOKBACK PERIOD.] Where the CCPA applies, the rights to know, access, correct, delete, and obtain a copy, and protections against discrimination, may be exercised through Section 9. We do not disclose personal information to third parties for their own direct marketing purposes within the meaning of California’s Shine the Light law.

11 Children and sensitive health records

Our public website and business signup are intended for adult professionals, not for children under 13. Practices may treat minors and use Mahla to handle their records. Those records remain subject to applicable agreements and laws governing minors’ consent, confidentiality, and representatives’ access. A parent’s or guardian’s right of access depends on the law and circumstances; it is not automatic for every record. Any child-facing feature requires the Practice and Mahla to satisfy the obligations applicable to that feature. Contact us if you believe a child has supplied information through our public website outside an authorized Practice workflow.

Some records receive additional protections, including Part 2 substance-use treatment records, separately maintained psychotherapy or SUD counseling notes, and information protected by state law. We apply the restrictions applicable to those records and our BAA. This policy is not a Part 2 consent, authorization to disclose psychotherapy notes, or permission to use records in proceedings against a patient.

12 Changes to this policy

We update the effective date when this policy changes and provide notice of material changes as required by law, such as through the website or an account communication. We obtain a new consent or authorization before processing when the law requires it. A revised website policy does not amend an existing BAA, expand our authority over patient records, or make a previously unauthorized use permissible. Continued use alone is not a substitute for legally required consent.

13 Contact us

Privacy contact: Pending confirmation: [MAHLA PRIVACY OFFICER OR TEAM]

Email: privacy@meetmahla.com

Mail: Mahla LLC, 1204 San Antonio Street, 2nd floor, Austin, Texas 78701

Privacy request method: Pending confirmation: [PRIVACY REQUEST FORM URL OR SECOND REQUIRED REQUEST METHOD]

Security concerns: security@meetmahla.com

For care questions, appointment changes, or access to medical records, contact your Practice directly. Avoid including sensitive medical information in an ordinary email to Mahla.