Privacy policy
This policy explains what information W31 Portal (the "Portal") handles, why, and how it is protected. The Portal is a private, invitation-only service that W31 LLC ("W31", "we") provides to independent clinical practices ("Practices") for administration and billing support.
1. Two kinds of information
Account information. When you sign in with Google, we receive your name, email address and profile picture from Google. We use them only to confirm who you are and which Practice you may open.
Practice records. Practices use the Portal to work with their clients' records: session notes, service authorizations, assessments, reports, billing hours and related documents. These records may include protected health information ("PHI"). The Practice is the owner of these records and the covered entity under HIPAA; W31 handles them only on the Practice's behalf, as its business associate, under a business associate agreement with that Practice.
2. Where Practice records are kept
Each Practice's records stay in that Practice's own Google Workspace account, including its Google Drive, Sheets and Docs. The Portal reads and writes them only through access the Practice has shared with the Portal. Practices never have access to one another's records.
To do its work, the Portal's servers process Practice records temporarily, for example while building a document or adding up billed hours. They do not keep a separate permanent copy. Operational logs may contain limited identifiers, such as a client number, and are kept for [log retention period] for troubleshooting and security.
3. How we use information
- To sign you in and keep each Practice's information separate.
- To provide the Portal's features: documentation, authorization tracking, reminders, billing summaries and administrative support.
- To keep the Portal secure, prevent misuse and fix problems.
We do not sell personal information, use it for advertising, or share it with data brokers.
4. Service providers
We use a small number of service providers to run the Portal. Each receives only what it needs to perform its function:
- Google (Google Workspace, Google Cloud): sign-in, and storage of Practice records in each Practice's own Workspace.
- Railway: hosting for the Portal's servers.
- Anthropic: AI-assisted reading of uploaded documents (for example referral forms) and drafting of report text. Every draft is reviewed by the clinician before use.
- Google Maps Platform: distance calculations for mileage reimbursement, using addresses only.
[Note for review: confirm that business associate agreements are in place with each provider that receives PHI, or limit what that provider receives.]
5. Google user data
The Portal's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The Portal asks Google only for your basic profile (name, email address and profile picture) to sign you in. It does not use Google user data for advertising, and it does not allow people to read that data except as needed to provide the service, for security, or to comply with law.
6. Cookies
The Portal uses only essential cookies that keep you signed in. It does not use advertising or analytics cookies.
7. Security
Connections to the Portal are encrypted (HTTPS). Each Practice runs in its own separate part of the Portal, and every request is checked against the Practice the user is allowed to open. Access to service credentials is limited to W31 LLC. No system is perfectly secure; if a breach affects Practice records, we will notify the affected Practice as required by our business associate agreement and applicable law.
8. Keeping and deleting information
Practice records remain in the Practice's own Workspace for as long as the Practice chooses to keep them. When a Practice stops using the Portal, it can remove the Portal's access to its files at any time, and we will remove the Practice from the Portal's registry.
9. Your rights
If you are a client of a Practice and want to see, correct or get a copy of your records, please contact that Practice directly. As its business associate, we will help the Practice respond. If you are a Portal user and want to know what account information we hold about you, contact us at the address below.
10. Children
The Portal is used by clinicians and administrators, not by children. Practice records may concern clients of any age; those records are handled on the Practice's behalf as described above.
11. Changes to this policy
We may update this policy. If we make significant changes, we will notify Practices before they take effect. The effective date at the top shows when it was last changed.
12. Contact
W31 LLC · [mailing address] · neli@prow31.com