Privacy Policy

1. Introduction

Catchsera, operated by Smart Zone Corp, is committed to protecting your personal data and Protected Health Information (PHI) in compliance with HIPAA and Massachusetts state law (M.G.L. c. 93H and 201 CMR 17.00).

This Privacy Policy applies to all visitors and clients of www.catchsera.com and www.care.catchsera.com.

2. Information We Collect

Account Data (from our clients — dental/medical offices):

• Business name and address
• Owner and contact person name
• Email address and phone number
• Billing information (processed securely via Stripe)

Communication Data (from patient callers):

• Caller name and phone number
• Reason for calling and preferred callback time
• Call recordings and transcriptions
• SMS logs generated by the AI Assistant

Website Data (automatic collection):

• IP address and browser type
• Pages visited and time spent
• Device type and referring website

What We Do NOT Collect:

• Social Security numbers
• Full insurance policy numbers
• Detailed medical histories or clinical information
• Credit card numbers (handled directly by Stripe)

3. How We Use Your Information

• To provide and operate our AI receptionist service
• To notify your team of incoming patient calls
• To process payments via Stripe
• To send service notifications and updates via SMS/email
• To improve our AI models and service quality
• To comply with legal obligations
• To respond to support requests

4. HIPAA Compliance

Catchsera functions as a Business Associate for healthcare clients under HIPAA (45 CFR Parts 160 and 164).

• We utilize AES-256 encryption for all data at rest and TLS 1.2+ for all data in transit
• We execute a Business Associate Agreement (BAA) with all covered entities before service activation
• Our AI agents are strictly restricted from collecting or discussing PHI beyond what is minimally necessary
• All call recordings involving healthcare patients are stored in HIPAA-compliant infrastructure
• Staff with access to PHI are trained on HIPAA requirements and bound by confidentiality obligations

5. SMS Privacy & Text Messaging

We operate two separate text messaging programs.

1. Messages to patients and customers, sent on behalf of our clients. When you call a clinic or business that uses Catchsera, we may send you a text message — but only if you have given express consent, either verbally on the recorded call or in writing. These messages are sent on behalf of the business you contacted; that business is the sender, and Catchsera (Smart Zone Corp) transmits the message for them. Every message identifies the business by name. Message types are limited to missed-call follow-ups, appointment reminders and confirmations, and replies to questions you asked. We send no marketing messages to patients. Message frequency varies. Message and data rates may apply.

2. Messages to prospective business clients. If you request a demo and check the SMS consent box, we may text you about your request. Message and data rates may apply.

For both programs:

• Mobile information will not be shared with third parties for marketing or promotional purposes
• SMS opt-in data and consent records will never be shared with any third parties
• Consent is not a condition of purchase, and is not a condition of receiving care
• Every consent record includes the date, time, and the exact wording agreed to
• To opt out of SMS: text STOP at any time
• For help: text HELP or email contact@catchsera.com

6. Data Retention

• Call Recordings: Retained 90 days then permanently deleted
• Account Data: Retained during subscription + 90 days after cancellation
• Billing Records: Retained 7 years as required by tax regulations
• Website Analytics: Retained 12 months then purged

To request data deletion, email legal@catchsera.com with subject "Data Deletion Request." We process within 30 days.

7. Data Sharing & Third Parties

Catchsera runs entirely on Microsoft Azure. We share data only with these providers:

• Microsoft Corporation — Every call, recording, transcript, and record we hold is stored and processed in Microsoft Azure in the United States. This includes Azure hosting, Azure Database for PostgreSQL, Azure Communication Services (telephony), and Azure AI Foundry (transcription and call analysis). Microsoft is bound by HIPAA business associate terms.
• Google Workspace — Used only to deliver call-notification emails to the staff of the clinic or business a caller contacted, so they can follow up. Google is bound by a HIPAA business associate amendment. (policies.google.com/privacy)

No one else receives patient information. We do not share it with advertisers, data brokers, or analytics companies. Our payment processor handles billing for our business clients only and never receives any patient or caller information.

All providers that may handle Protected Health Information are bound by Business Associate Agreements in compliance with HIPAA 45 CFR Parts 160 and 164.

8. Cookies

Our website uses minimal cookies for basic functionality, analytics, and session management. We do NOT use advertising or tracking cookies. You can disable cookies in your browser settings.

To improve this website we count, without cookies, which pages are viewed, how long a page stays open, how far it is scrolled and which links or buttons are clicked. A random code that ends when you close the browser tab groups the pages of one visit. We do not record your IP address, your name, or anything you type into forms. These statistics are kept for 12 months.

9. Your Rights

• Access — Request a copy of data we hold about you
• Correction — Request correction of inaccurate data
• Deletion — Request deletion of your data
• Portability — Request your data in a portable format
• Opt-Out — Opt out of SMS communications anytime by texting STOP

To exercise any right, email legal@catchsera.com with subject "Privacy Rights Request."

10. Security

• AES-256 encryption for data at rest
• TLS 1.2+ encryption for data in transit
• Access controls and role-based authentication
• Regular security reviews and monitoring

In the event of a data breach, we will notify you within 72 hours as required by Massachusetts law (M.G.L. c. 93H).

11. Children's Privacy

Our services are intended for business use only and directed to adults operating healthcare practices. We do not knowingly collect personal information from anyone under 18 years of age.

12. Changes to This Policy

We will notify you of material changes by email at least 14 days before they take effect. The "Last Updated" date at the top reflects the most recent revision. Continued use of our services after changes constitutes acceptance.