Privacy Policy
Last Updated: October 11, 2026
1. Introduction
Practice Harbor (practiceharbor.com), a digital product of Somatopia, LLC ("we," "our," or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our clinical documentation platform and related services (collectively, the "Services").
We understand the sensitive nature of healthcare data and take our obligations to protect your privacy seriously. This Privacy Policy is designed to help you understand our practices and your rights regarding your information.
2. Information We Collect
2.1 Information You Provide
We collect information that you provide directly to us, including:
Account registration information (name, email, professional credentials)
Practice or organization information
Patient health information and clinical documentation
Audio from clinical sessions (when using transcription features), processed in real time and deleted after processing
Payment and billing information
Communications with our support team
2.2 Automatically Collected Information
When you use our Services, we automatically collect certain technical information, including:
Device and browser information
Usage data and interaction with our Services
Performance and error data
3. How We Use Your Information
We use the collected information for the following purposes:
Providing and improving our Services
Processing and generating clinical documentation
Communicating with you about our Services
Ensuring compliance with legal and regulatory requirements
Detecting and preventing fraud or abuse
4. HIPAA Compliance
As a provider of services to healthcare professionals, we understand and comply with the Health Insurance Portability and Accountability Act (HIPAA). We maintain appropriate physical, technical, and administrative safeguards to protect Protected Health Information (PHI).
When you use our Services to process PHI, our relationship is governed by a Business Associate Agreement (BAA). We only use and disclose PHI as permitted by our BAA and applicable law.
5. Data Retention and Deletion
We retain your information for as long as necessary to provide our Services and comply with our legal obligations. For PHI, we follow HIPAA retention requirements and our BAA terms.
You may request deletion of your account and associated data at any time. Upon request, we will delete your data within sixty (60) days, except where retention is required by law (e.g., tax records) or necessary to resolve an active billing dispute. We will confirm deletion upon request. See how to delete your account.
6. Data Security
We implement appropriate technical and organizational measures to protect your information, including:
Encryption of data in transit and at rest
Access controls and authentication requirements
Regular security assessments and audits
Employee training on privacy and security
Incident response procedures
7. Sharing Your Information
We do not sell your personal information or PHI, and we never share PHI for advertising. We may share your information in limited circumstances:
With your consent or at your direction
With service providers who help us operate the platform — specifically cloud hosting (AWS), payment processing (Stripe), and AI inference providers — all of whom are bound by Business Associate Agreements with protections no less restrictive than our own
With Meta Platforms, for advertising measurement, limited to visits to our public marketing pages and sign-up events as described in Section 8 — never PHI, and never from inside the app
As required by law or to protect rights and safety
In connection with a merger or acquisition, provided that any successor agrees to honor this Privacy Policy and all existing BAA obligations, and we notify you at least thirty (30) days in advance
7.1 Text Messages (SMS)
If a client opts in to text message appointment reminders, we use their mobile number and consent only to send those messages. Mobile numbers and text message opt-in data and consent are never shared with, sold, or rented to third parties or affiliates for marketing or promotional purposes. They are disclosed only to the telecommunications providers that deliver the messages. Clients can reply STOP to any message to opt out. See our Text Messaging Terms.
8. Cookies, Advertising and Your Choices
Our public marketing pages on practiceharbor.com — such as the home page, blog, guides, comparison pages and sign-up page — use the Meta Pixel, an advertising cookie and script from Meta Platforms, Inc., for visitors in the United States. Our free tools pages, which anyone may use, do not load it. It tells us when someone visits those pages or creates an account, so we can measure our ads and show them to people who may be interested in Practice Harbor.
The Meta Pixel never runs inside the Practice Harbor app (secure.practiceharbor.com), the client portal, our phone apps, or any page that contains client or patient information, and we never send Meta protected health information. When you create an account we tell Meta only that a sign-up happened — not your name, email address, or anything you entered.
When the pixel runs, Meta receives the address of the public page you visited, your browser and device information, your IP address, and Meta's cookie identifiers. Meta processes this under its own privacy policy and may combine it with information it already has about you.
Your choices
Turn advertising cookies off for this browser with the switch below
We honor Global Privacy Control (GPC): if your browser sends it, the pixel never loads
You can also block cookies in your browser settings, or adjust your ad preferences in your Meta account
California residents: using the Meta Pixel for advertising may be considered “sharing” personal information for cross-context behavioral advertising under California law. You can opt out of that sharing with the switch below or by enabling Global Privacy Control.
9. Google API Services and Google Calendar Integration
Practice Harbor offers an optional Google Calendar integration that lets clinicians sync their appointment schedule with their own Google Calendar. If you choose to connect your Google account, we access your calendar data solely to provide this feature: creating, updating, and removing calendar events that correspond to your Practice Harbor appointments, and reading your calendar availability so conflicting times are not offered for booking.
Practice Harbor's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In keeping with those Limited Use requirements:
We only use Google Calendar data to provide and improve the calendar sync feature you requested — never for advertising, and never for purposes unrelated to that feature
We do not sell Google user data, and we do not transfer it to third parties except as necessary to provide the feature, to comply with applicable law, or as part of a merger or acquisition with notice as described above
Humans do not read your Google Calendar data unless you give us explicit permission (e.g., for support), it is necessary for security or to comply with law, or the data has been aggregated and anonymized
We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models
You can disconnect the integration at any time from your calendar settings, which removes our access and deletes stored Google credentials
10. Your Rights and Choices
You have the following rights regarding your information:
Access and obtain a copy of your information
Correct inaccurate information
Request deletion of your information
Restrict or object to certain processing
Data portability
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated Privacy Policy on our website and, where required by law, seeking your consent.
12. Contact Us
If you have any questions about this Privacy Policy or our privacy practices, please contact us at:
Practice Harbor
A digital product of Somatopia, LLC
1 H St #203
San Rafael, CA 94901
Email: privacy@practiceharbor.com
Effective Date: October 11, 2026