Privacy Policy & Legal Disclosures

1. Overview & Scope

This Privacy Policy describes how SpecialtyDox LLC ("Company," "we," "us," or "our"), operating the SpecialtyDox RTM platform at rtm.specialtydox.com, collects, uses, discloses, and safeguards information in connection with our Remote Therapeutic Monitoring (RTM) services.

SpecialtyDox RTM is a healthcare software platform designed for licensed healthcare providers and medical practices ("Practice Users") to monitor and manage patient therapeutic programs including CPAP therapy and Cognitive Behavioral Therapy for Insomnia (CBT-I).

2. HIPAA Compliance & Protected Health Information

SpecialtyDox LLC operates as a Business Associate under HIPAA and the HITECH Act. We implement and maintain administrative, physical, and technical safeguards to protect PHI. We use and disclose PHI only as permitted by our Business Associate Agreement (BAA) and applicable law.

3. Information We Collect

Practice User Information

• Name, professional credentials, and contact information
• Practice name, NPI number, and Tax ID
• Account credentials (email and encrypted password)
• Billing and subscription information

Patient Health Information (PHI)

• Patient demographics (name, date of birth, contact information)
• Insurance information and member IDs
• CPAP device data (usage hours, AHI, leak rates, pressure settings)
• Sleep diary entries and CBT-I program data
• Clinical notes, encounter documentation, and assessment scores
• SMS message history for text monitoring programs

4. How We Use Your Information

• Provide and operate the SpecialtyDox RTM platform
• Enable remote therapeutic monitoring of enrolled patients
• Generate billing eligibility reports and clinical documentation
• Send authorized SMS communications to patients on behalf of practices
• Comply with legal obligations and regulatory requirements

5. SMS / Text Message Policy (A2P 10DLC)

Message Types

• CPAP Monitoring: Compliance reminders, device troubleshooting, supply reminders, monthly check-ins, AHI alerts, appointment reminders
• CBT-I Monitoring: Sleep diary reminders, coaching messages, weekly check-ins, ISI assessments, sleep window updates
• Daily Check-Ins: Automated morning check-ins requesting sleep quality ratings and clinical follow-up data

Consent Requirements

Before any patient receives SMS messages, the enrolling practice must obtain and document written patient consent for remote text monitoring, disclosing message types, frequency, potential carrier charges, and opt-out instructions.

Message Frequency

CPAP RTM patients may receive up to 1 message per day. CBT-I patients may receive up to 2 messages per day during active program weeks.

Opt-Out

Reply STOP to any message to opt out immediately. A single confirmation will be sent. No further messages will follow.

Opt-In

Reply START to re-enroll in text monitoring after opting out.

HELP

Reply HELP to receive support contact information: hello@specialtydox.com

Carrier Compliance

SpecialtyDox RTM complies with all CTIA guidelines, carrier requirements, and TCR A2P 10DLC registration requirements. Our campaigns are registered for healthcare remote monitoring communications.

6. Data Sharing & Disclosure

We may share information with: healthcare providers (as necessary for RTM services), our service providers, each under a written agreement and, where protected health information is involved, a Business Associate Agreement executed before any PHI is shared; and legal authorities when required by law. We do not share PHI with insurance companies, employers, marketers, or data brokers.

7. Data Security

• TLS 1.2+ encryption in transit
• AES-256 encryption at rest on AWS RDS
• AWS infrastructure in us-east-2 (Ohio)
• Role-based access controls
• Full audit logging of PHI access
• Automatic session timeout
• Incident response plan with defined breach notification procedures

8. Data Retention

PHI is retained for a minimum of 6 years from creation or last effective date per HIPAA requirements. Upon subscription termination, data is retained for 90 days before deletion unless required longer by law.

9. Your Rights

Practice Users

• Right to access and correct your account data
• Right to request account deletion (subject to retention requirements)
• Right to data portability upon request

Patient Rights

Patients have HIPAA rights including access, amendment, and accounting of disclosures. These rights must be exercised through your healthcare provider (Covered Entity), not directly through SpecialtyDox LLC.

10. Business Associate Agreement

Any practice using SpecialtyDox RTM to store or process PHI must execute a BAA with SpecialtyDox LLC prior to enrolling patients. To request a BAA contact hello@specialtydox.com. BAAs are executed within 3 business days of request.

11. Terms of Service

Practice Responsibilities

• Obtain and document patient consent before enrolling in SMS monitoring
• Ensure all platform users are authorized staff
• Maintain confidentiality of login credentials
• Comply with all applicable federal and state healthcare laws
• Execute a BAA prior to entering PHI

Subscription & Billing

SpecialtyDox RTM is billed monthly per enrolled patient. Practices may cancel with 30 days written notice. Contact hello@specialtydox.com for current pricing.

Limitation of Liability

SpecialtyDox RTM is a technology platform to support clinical workflows and is not a substitute for clinical judgment. SpecialtyDox LLC total liability shall not exceed fees paid in the 3 months prior to any claim.

Governing Law

These terms are governed by the laws of the State of Texas. Disputes shall be resolved in Travis County, Texas.

12. Contact & Complaints