Patient Privacy Policy

1. Scope and purpose

This Patient Privacy Policy applies when a healthcare practice, clinic, health system, or other healthcare organization uses Vocari to communicate with you or perform an authorized administrative workflow. This may include voice conversations, appointment requests, insurance intake or verification, routing, follow-up preparation, and secure digital forms.

This Policy supplements the healthcare organization's own privacy notices. It does not replace its Notice of Privacy Practices, describe every way the organization uses your health information, or create a direct provider-patient relationship between you and Vocari.

2. What Vocari does

Vocari provides software that helps healthcare organizations receive and document patient requests, answer organization-approved administrative questions, schedule or manage appointments when enabled, collect information needed for insurance and revenue-cycle workflows, route requests, and create follow-up work for staff.

Vocari may use automated voice and language technologies to conduct an interaction and transform the conversation into a transcript, summary, structured workflow record, and requested action. The healthcare organization configures the permitted workflow, approved information, integrations, and escalation rules.

3. The healthcare organization's role and Vocari's role

The healthcare organization

The healthcare organization determines why the workflow is used, what information is needed, which staff may access it, what actions Vocari may perform, and how the results become part of its operations or patient record. Contact the organization for its Notice of Privacy Practices and questions about treatment, payment, healthcare operations, or your medical record.

Vocari

Vocari processes information according to the healthcare organization's instructions and the agreements between Vocari and that organization. When HIPAA applies, Vocari generally acts as the organization's Business Associate and uses or discloses PHI only as permitted by the applicable Business Associate Agreement, the services agreement, and law.

4. Information we handle

The exact information depends on the healthcare organization's configured workflow. Vocari may handle:

• Identity and contact information, such as name, telephone number, email address, mailing address, date of birth, and identifiers used by the healthcare organization.
• Relationship and representative information, such as whether you are the patient, a parent, guardian, caregiver, or other personal representative.
• Appointment and access information, such as requested service, reason for contact, preferred location, provider preference, available times, appointment history, referral status, and requested follow-up.
• Health and care-related information, such as symptoms or concerns you choose to describe, practice-approved intake responses, and information needed to route the request. Vocari is intended for administrative access and does not independently determine a diagnosis or treatment.
• Insurance and billing information, such as payer name, plan, member and group identifiers, subscriber relationship, eligibility details, claim identifiers, and provider information needed for an authorized transaction.
• Interaction content, including call transcripts, form responses, summaries, structured outputs, actions attempted, actions completed, and staff-review status.
• Technical and security information, such as telephone routing information, timestamps, authentication results, integration events, and records needed to secure and audit the workflow.

5. How information is collected

Vocari may collect information:

• directly from you during a telephone interaction or secure form;
• from the healthcare organization and its authorized staff;
• from an electronic health record, practice-management system, scheduling system, payer, clearinghouse, or other integration authorized by the healthcare organization;
• from actions performed during the workflow, such as a booking attempt or eligibility transaction; and
• automatically from communications and security systems needed to connect, protect, and document the interaction.

A caller's telephone number and information provided during the interaction may be used to search for a patient record. A possible match is not treated as verified solely because a telephone number matches. Where identity remains uncertain, Vocari is designed to limit disclosure and route the request for staff review.

6. How information is used

Subject to the healthcare organization's instructions, Vocari may use information to:

• answer organization-approved administrative questions;
• identify or create a patient-access record;
• schedule, reschedule, cancel, confirm, or review an appointment when enabled;
• collect insurance information and perform an authorized eligibility, claim-status, or related transaction when enabled;
• route a call or request to the correct location, provider, department, or staff queue;
• prepare a transcript, summary, structured outcome, follow-up task, or audit record;
• operate, secure, diagnose, and support the configured workflow; and
• comply with the healthcare organization's instructions, applicable agreements, and law.

Vocari does not sell patient information, use it for targeted advertising, or use patient interaction data to train Vocari-owned generalized artificial intelligence models.

7. How information is disclosed

Vocari may disclose patient information:

• To the healthcare organization. Information and workflow results are made available to its authorized workforce and connected systems.
• To authorized service providers and subprocessors. Providers may support telecommunications, language processing, cloud infrastructure, databases, identity, healthcare transactions, and secure communications. Their access is limited to providing the contracted service and is subject to applicable contractual safeguards. When a subcontractor creates, receives, maintains, or transmits PHI on Vocari's behalf, Vocari requires a Business Associate Agreement where HIPAA requires one.
• To recipients configured by the healthcare organization. For example, an approved scheduling system, payer, clearinghouse, clinician, location, or follow-up destination may receive the information necessary for the requested workflow.
• As required by law or for safety and security. Information may be disclosed when required by lawful process or reasonably necessary to investigate abuse, respond to a security incident, or protect rights and safety.
• At your or the healthcare organization's direction. Vocari may make a disclosure when an authorized party requests or consents to it.

Vocari does not disclose patient information to data brokers or unrelated marketers.

8. Automation and human review

Vocari uses automated systems to understand administrative requests, retrieve healthcare-organization-approved information, and carry out configured actions. Automated output may be incomplete or inaccurate, so the service includes workflow boundaries, confirmation steps, validation, and human escalation.

Requests involving uncertain identity, clinical judgment, emergencies, unsupported actions, major procedures, conflicting information, failed integrations, or other configured safety conditions are directed to the healthcare organization's staff. The healthcare organization remains responsible for clinical decisions, patient care, review of flagged work, and the final use of information in its records.

9. Calls, transcripts, and audio

Audio must be processed in real time for an automated voice interaction to occur. Vocari's current product is configured to retain transcripts, summaries, structured outcomes, and workflow records rather than patient call recordings. Vocari does not provide a patient-call recording library in the current product.

Telecommunications and voice-processing providers may transiently process call audio to connect and transcribe the interaction under Vocari's and the healthcare organization's configured service. A healthcare organization may also have separate telephone systems or recording practices outside Vocari. Any notice you hear during a call may describe those practices. Contact the healthcare organization with questions about its call policies.

10. Security safeguards

Vocari uses administrative, physical, and technical safeguards designed for the sensitivity of patient information. Current application safeguards include individual password-protected user accounts, role and workspace authorization, encrypted communications, server-side protection of provider credentials, authenticated integration events, audit records for sensitive-data access and selected administration events, restricted caching of protected responses, input validation, and controls intended to prevent replayed or duplicate workflow actions.

No electronic system can guarantee absolute security. Vocari investigates suspected unauthorized access and cooperates with the healthcare organization concerning security incidents and legally required notifications.

11. Retention and deletion

Retention depends on the healthcare organization's instructions, the service configuration, the applicable agreement and BAA, operational and security requirements, and law. Vocari may retain transcripts, structured outcomes, workflow records, audit records, and integration records for the period established in those materials.

When information is no longer required, Vocari deletes, de-identifies, or isolates it from further use, subject to lawful retention duties and technical backup cycles. If immediate deletion from a backup is not feasible, the information remains protected and is not restored for ordinary business use.

12. Patient and consumer rights

Requests involving a medical or patient record

Contact the healthcare organization to request access, amendment, correction, restriction, confidential communication, or an accounting relating to your medical record or PHI. The healthcare organization is responsible for verifying your identity and determining the legally required response. Vocari will assist it as required by the applicable BAA, contract, and law.

Requests involving information Vocari controls directly

If Vocari collected information from you for its own business purposes, applicable state law may provide rights to know, access, correct, delete, or obtain a portable copy of that information, and to appeal a decision. Submit such a request to info@vocarihealth.co. We may verify your identity and authority before responding. Healthcare information governed by HIPAA may be exempt from state consumer privacy laws.

13. Minors and personal representatives

Vocari does not offer an independent consumer service directed to children. A healthcare organization may use Vocari in connection with pediatric care. In that context, the healthcare organization determines whether a parent, guardian, or other personal representative may act for a minor and is responsible for any legally required notice, consent, and verification.

14. Emergencies and clinical care

Vocari supports administrative patient access. It does not provide medical advice, diagnose a condition, prescribe treatment, independently determine medical necessity, or replace a licensed clinician. Vocari is not an emergency service. Call 911 or the appropriate local emergency number when immediate assistance is required.

15. Changes and contact

Vocari may update this Patient Privacy Policy to reflect changes in the Services, our practices, or legal requirements. The revised version will be posted with a new effective date and additional notice will be provided when required.

Questions about a specific interaction, appointment, insurance transaction, or patient record should be directed to the healthcare organization. General questions about Vocari's privacy practices may be sent to info@vocarihealth.co.