Privacy Policy

1. Who we are and what this covers

This Privacy Policy explains how Solos Agent Labs, a California general partnership doing business as Solos ("Solos," "we," "us") handles personal information in connection with Solos Care Line: the website at health.heysolos.com, the clinic portal, the demo, the trial text line, and the messages sent to and from numbers we operate (the "Service"). Washington, Nevada and Connecticut residents should also read our Consumer Health Data Privacy Policy. Capitalized terms not defined here have the meaning in our Terms of Service.

2. Our role: clinics control patient information

When a clinic uses the Service to text its patients, the clinic decides what information is collected and why. We process that information on the clinic's behalf and on its instructions, as its service provider (and, where we have signed one, under a business associate agreement). The clinic's own privacy notice, and its obligations under HIPAA and other laws, govern that information. If you are a patient, send privacy requests to your clinic; if you send them to us, we will pass them to your clinic where we can and may not respond directly. This policy describes our own practices; it does not limit what a clinic may do with information it holds.

3. Information we collect

• Messages. Your phone number, the content of messages you send and receive (text, and a note that a photo or file was sent; we don't keep attachments), reactions, timestamps, delivery status, and the service type (such as iMessage or SMS) reported by our messaging provider.
• Patient details a clinic provides. Such as name, care stage, upcoming visits, care team and checklist items, which may include health information.
• Information the Service derives. Such as a short conversation summary, open requests, signals that a patient may need a call, safety flags, and records of how each reply was checked.
• Clinic staff and contacts. Name, work email, role, clinic details and anything you send through our contact form.
• Technical information. IP address, browser and device type, pages requested, timestamps, a session cookie, and server and error logs.

We collect this from you, from your clinic, from our messaging and hosting providers, and automatically when you use the Service.

4. How we use it

• To provide the Service: answer messages, route requests to the clinic, send reminders the clinic turned on.
• To check replies before they are sent, detect possible emergencies, and alert the clinic's team (safety is a core purpose; it is why messages are analyzed).
• To secure the Service, prevent abuse and fraud, enforce limits and our Terms, and debug problems.
• To review quality and improve the Service. For the demo and trial line this includes people on our team reading conversations. For clinic patient data, we do this only as the clinic's agreement permits.
• To communicate with clinics and people who contact us, and to answer questions.
• To comply with law, respond to lawful requests, and establish, exercise or defend legal claims.

We may create de-identified or aggregated information (for example, how many messages were answered) and use it for any lawful purpose. We will keep it in de-identified form and won't try to re-identify it, except to test our de-identification.

5. AI processing

Messages and the clinic-approved information needed to answer them are sent to large language models operated by third-party AI providers (currently through OpenRouter, to models from Anthropic, OpenAI and Google), which write and independently check each reply. We send only what is needed for the reply and do not ask these providers to train on it; where a provider or OpenRouter offers a setting not to retain or train on data, we use it where available. Their handling is governed by their own terms, which we don't control. We don't use clinic patient data to train our own models.

6. How we share it

• With your clinic. A clinic's authorized staff see its patients' conversations, summaries and alerts.
• With service providers that run the Service for us under contracts that limit their use: Fly.io (hosting), Neon (database), Sendblue (iMessage and SMS delivery and contact management), OpenRouter and the AI providers listed above, and the mobile carriers and Apple that carry messages. We may change providers.
• For legal reasons: to comply with law, subpoena or court order; to protect the rights, property or safety of Solos, our users or others; or in an emergency involving risk of harm to a person.
• In a business transfer, such as a merger, financing, acquisition, reorganization or sale of assets, subject to this policy.
• With your direction or consent.

We don't sell personal information, share it for cross-context behavioral or targeted advertising, or share mobile numbers or text-messaging opt-in data with any third party or affiliate for their marketing. We haven't done so in the past 12 months. We don't knowingly sell or share the information of anyone under 16.

7. Cookies and tracking

We use one essential cookie to keep a demo or portal session signed in. We don't use advertising cookies, third- party analytics, tracking pixels or session-replay tools. Because we don't track you across sites, we treat Global Privacy Control and Do Not Track signals as already honored.

8. Retention

• Demo and trial-line conversations, and messages from numbers that aren't registered with a clinic, are deleted about 7 days after the last message, and the trial contact is removed from our messaging provider.
• Clinic data is kept for the clinic's subscription and then deleted or returned as its agreement provides.
• Opt-out (STOP) records are kept as long as needed to keep honoring them and to prove compliance. Logs, backups and records we must keep by law or for legal claims are kept for as long as needed for those purposes.

9. Security

We use administrative, technical and physical safeguards designed to protect information, including keeping each clinic's data separate at the database level, encrypting phone numbers and messages with per-clinic keys, and limiting staff access. No method of storage or transmission is completely secure, and we can't guarantee the security of information. Text messages travel over carrier and Apple networks that we don't control. If we learn of a security incident affecting your information, we will notify you or your clinic as the law requires.

10. Your choices and rights

• Texts. Reply STOP to stop texts from a number and START to resume. You may also opt out by any reasonable means, including emailing team@heysolos.com.
• State privacy rights. Depending on where you live (including California, Colorado, Connecticut, Virginia, Texas, Oregon and other states), you may have the right to know or access the personal information we hold about you, to correct or delete it, to receive a copy, to opt out of sale, sharing, targeted advertising or profiling with significant effects (we don't do these), and to appeal our decision. We use sensitive personal information only for purposes the law allows, so we don't offer a separate right to limit it.
• How to ask. Email team@heysolos.com from, or with, the phone number or email the request is about. We verify requests by confirming details we hold, may ask for more information, and may decline where the law allows (for example, for information we process for a clinic, which we refer to the clinic). You may use an authorized agent with your signed permission. To appeal a decision, reply to our response with "appeal." We won't discriminate against you for exercising your rights.

11. Children

The Service is not directed to, and may not be used by, anyone under 18. We don't knowingly collect information from children. If you believe a child has sent us information, email team@heysolos.com and we will delete it.

12. United States only

The Service is intended for people in the United States, and information is processed and stored in the United States. If you use it from elsewhere, you do so on your own initiative and consent to that processing.

13. Changes

We may change this policy at any time. The new version applies from the "Last updated" date at the top. If a change is material, we'll also tell subscribing clinics by email or in the portal before it takes effect. If we ever want to use personal information in a materially different way from what this policy describes at the time it was collected, we will ask for consent where the law requires.

14. Contact

Solos Agent Labs, a California general partnership doing business as Solos. Email team@heysolos.com.