Effective Date: May 7, 2026 · Last Updated: June 2, 2026
Protecting your health information and respecting your privacy choices is foundational to Prisma. This Privacy Policy explains what we collect, how we use and protect it, who we share it with, and the choices and rights available to you, including your rights under HIPAA. Please read this carefully alongside our Terms and Conditions.
Aurelis Insights, Inc. ("we," "us," or "our") operates Prisma, a health data platform for patients and patient communities. This Privacy Policy applies to all users of the App and related services.
If you are a patient who uses this App or whose health records are accessed or processed through the App, this Policy applies to you. If you are accessing the App as a caregiver or legal representative of another individual, this Policy applies to your use on their behalf.
Some or all of the health information we handle may constitute Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). As such, we treat all health information you provide with the highest standards of privacy and security.
Health Records. With your explicit authorization, we retrieve health records from your healthcare providers and health plans. This may include diagnoses, medications, lab results, vitals, visit notes, and insurance claims data.
Self-Reported Information. We collect health information you enter directly through surveys, questionnaires, and symptom or lifestyle trackers within the App. This may include your symptoms, health goals, medications you self-report, lifestyle information, and responses to health assessments.
Account Information. Name, date of birth, email address, and credentials you use to create and access your account.
Usage and Technical Data. Information about how you interact with the App, including features accessed, session duration, device type, operating system, App version, IP address, and access timestamps. This data is used to maintain and improve the App and will not be used to build advertising profiles.
Communications. If you contact our support team, we retain records of those communications.
We do not sell, rent, or trade any of your identifiable personal or health information to third parties for their own marketing or commercial purposes.
We use the information we collect to:
We will not use your identifiable health information to train AI or machine learning models, or for any purpose materially inconsistent with this Policy, without your separate, explicit consent.
We do not sell your identifiable personal or health information. We share your information only as follows:
Service Providers (Business Associates). We engage vendors and contractors who process health information on our behalf, including cloud infrastructure providers, analytics vendors, and customer support tools. Where these vendors handle PHI, we enter into HIPAA-compliant Business Associate Agreements with them.
Third-Party AI Services. When you interact with our AI-powered chat feature, we share certain information with our third-party AI infrastructure provider, Amazon Web Services, Inc. (AWS), to process your requests and generate responses. What is sent: the text prompts and questions you type into the chat interface, along with contextually relevant data from your Personal Health Summaries. Purpose: to power real-time conversational responses and health data navigation assistance. Protections: we access these AI services strictly through private, enterprise-grade APIs under a HIPAA-compliant Business Associate Agreement. The provider is contractually required to maintain the same or equal levels of data privacy and security protections as outlined in this Policy, and is strictly prohibited from storing, retaining, or using your data to train public AI models or for any purpose outside of generating the immediate response.
Health Data Intermediaries. Where we use a third-party intermediary to facilitate EHR connections, we share data with that intermediary solely to enable your authorized data connections. Their use of your data is governed by their privacy terms.
Research Partners. With your separate, explicit consent, we may share de-identified or identified data with research partners, patient advocacy organizations, or life sciences companies. We will always describe the scope of any such sharing clearly before asking for your consent, and you will never be required to participate as a condition of using the App.
Legal Compliance. We may disclose your information when required by law, court order, regulatory authority, or government request. We will scrutinize all such requests and disclose only what is legally required. Where permitted, we will notify you before complying.
Business Transfers. In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred to a successor entity. We will notify you of any such change and any choices you may have regarding your data.
With Your Consent. We may share information for other purposes with your explicit prior consent.
You have the following rights regarding your information, which you may exercise by contacting us at privacy@ourprisma.com:
We will process your requests within 30 days. We will never retaliate against you for exercising any of these rights.
Where your information constitutes PHI, you have additional rights under HIPAA, including:
We implement strict administrative, technical, and physical safeguards designed to protect your health information consistent with the HIPAA Security Rule and industry best practices. Our measures include:
No system is completely secure. In the event of a breach affecting your PHI, we will notify you in accordance with the HIPAA Breach Notification Rule and applicable state breach notification laws.
We retain your personal and health information for as long as your account is active, as needed to provide the services, or as required by law. When your data is no longer needed, we securely delete or de-identify it consistent with our data retention schedule. De-identified data may be retained indefinitely as part of aggregate analytical datasets.
We use cookies and similar technologies to maintain your login session, remember your preferences, and understand how users engage with the App. We do not use cookies or tracking technologies to build advertising profiles or share your activity with ad networks. You may be able to control cookie settings through your browser or device settings, though some features may not function correctly if you disable certain cookies.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or prominent in-App notice before the changes take effect. The "Last Updated" date at the top of this Policy will always reflect the most recent revision. Your continued use of the App after changes take effect constitutes your acceptance of the updated Policy.
For questions, requests, or concerns about this Privacy Policy or our privacy practices, please contact:
Aurelis Insights, Inc., Privacy Officer
Email: privacy@ourprisma.com
If you believe your privacy rights have been violated, you have the right to file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights (OCR) at hhs.gov/ocr, by phone at 1-800-368-1019, or by mail. You will not be penalized or retaliated against for filing a complaint.