Snapshot 49131
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Privacy Policy
Last Updated: July 2026
The plain-language summaries (marked with 👉) are provided for convenience only and are not legally binding. If there's any conflict, the formal language controls.
HIPAA Compliant
Enterprise-grade safeguards for your health data
Encrypted
Data protected in transit and at rest
You Own Your Data
Patient agency means patient data ownership. Access, download, or delete anytime.
No Data Sales
We never sell your information
1Introduction
Alcott, Inc. ("Alcott," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our services.
Our goal is to help you organize your health information and prepare for medical visits. Alcott, Inc. is not a medical device and does not provide medical advice, diagnosis, or treatment. The Services are intended for use within the United States. See our Terms of Service for eligibility, account terms, and recording consent requirements.
👉 Translation: We're here to help you get organized, not to act as your doctor. And yes — for now, we're only built for U.S. users.
2What We Collect
Alcott Visit Companion (visit.alcottai.com)
Account Information
When you create an account, you provide basic information like your name, email, date of birth, and phone number, or use Google authentication.
Health Information
You may provide health information through several features:
Visit Preparation: Chat conversations about your symptoms, questions, and health concerns for upcoming appointments
Medical Record Upload: Documents you upload (lab results, medical notes, PDFs) which you can view and chat with our AI about
Scribe: Audio recordings of your medical visits, which are transcribed and summarized (see Scribe section below)
Provider Sharing: Visit summaries that you choose to share with your healthcare providers
My Family
If you are completing a visit on behalf of someone else (such as a child or elderly family member), we collect your name as the caregiver and the patient's name and health information.
Technical Data
We collect technical data (device type, browser, IP address, crash reports) to keep the service working properly.
👉 Translation: We collect what you give us — your account info, health details you share, documents you upload, and basic technical info to keep things running. If you're helping a family member, we note that too.
Scribe Feature
When you use our Scribe feature to record a medical visit:
Audio recordings are deleted immediately after transcription — we never store audio
Transcripts and Summaries are stored according to our retention policy below
Before recording, you will see a notice reminding you to inform your healthcare provider. You are responsible for complying with applicable recording consent laws in your jurisdiction.
👉 Translation: Record your visit, get a summary, and we delete the audio right away. Always let your doctor know you're recording.
Alcott Forms
Alcott automates medical form completion for providers. When providers use this feature, we store blank form templates and their fields. Completed patient forms are generated in real time from visit data and delivered to the provider — they are not stored by Alcott.
👉 Translation: Alcott helps providers fill out paperwork faster. We keep the blank templates, but completed patient forms aren't stored.
Provider Integrations
When healthcare providers connect Alcott to their existing systems (such as CRM or EHR platforms), we may receive patient contact information (name, email) and appointment details (date, time, provider) to initiate visit preparation. This data originates from the provider's systems. Upon completion, Alcott may write clinical visit summaries generated by our Services back to the provider's connected system. Data exchanged through provider integrations is used solely to deliver Alcott services.
3How We Use and Share Information
We use your information to operate the Services, generate visit preparation summaries, transcribe and summarize recorded visits, enable sharing with caregivers or clinicians if you choose, and send important service communications. We do not sell your information or use health data for advertising.
We share information only with trusted service providers:
Provider Purpose
AWS Hosting, AI processing (Bedrock), transcription (Transcribe Medical), Document processing (not retained)
Supabase Database (self-hosted on AWS)
Twilio SMS and MFA
Stripe Payment processing (providers only)
Google Authentication (if selected by user)
HubSpot Provider CRM integration
Keragon Workflow automation connecting provider EHR systems to Alcott
Practice Better Provider EHR Integration
We may also share information if required by law or to protect safety.
SMS Program Data: No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories of information sharing exclude text messaging originator opt-in data and consent; this information will not be shared with, sold to, or purchased by any third party for any purpose.
For Healthcare Providers: If you use Alcott as a healthcare provider to send visit links to patients, please see our Business Associate Agreement in our Terms of Service.
👉 Translation: We use your info to run Alcott, not to run ads. And we only share with vendors who help make the service work.
4Data Retention
User Type Health Content Anonymized Metadata
Authenticated (active) Until you delete or close account Indefinitely
Authenticated (closed) Deleted within 30 days Anonymized & kept
Unauthenticated Deleted after 90 days Anonymized & kept
Scribe-specific retention:
Audio recordings: Deleted immediately after transcription
Transcripts and Summaries: Follow retention policy above
Provider-linked users: If you access Alcott through a healthcare provider's invitation without creating an account, your data is retained until the provider's agreement with Alcott ends, plus 30 days.
Anonymized metadata includes non-identifying information like visit types, feature usage patterns, and question categories. This data cannot identify you and helps us improve our services.
👉 Translation: With an account, your stuff stays until you delete it. Without one, it disappears after 90 days. We keep anonymous stats to make Alcott better.
5Security
We use industry-standard security including encryption, access controls, and system monitoring. We conduct regular security assessments and maintain HIPAA-compliant safeguards. In case of a data breach, we'll notify users as required by law.
👉 Translation: We lock the doors, set alarms, and if anything ever goes wrong, we'll tell you.
6HIPAA Compliance
Alcott maintains administrative, technical, and physical safeguards to protect your health information in accordance with HIPAA requirements. This includes:
Encryption of data in transit and at rest
Access controls and audit logging
Business Associate Agreements with our vendors
Regular security assessments
Incident response procedures
For healthcare providers using Alcott, a Business Associate Agreement is included as part of our Terms of Service.
👉 Translation: We take HIPAA seriously and follow the rules to protect your health info.
7Your Rights
You can access, download, or delete your information and close your account anytime. To exercise these rights, contact us at legal@alcottai.com. We will respond within 30 days.
👉 Translation: Your data is your call. Email us and we'll help.
8Children
We don't collect data from children under 13. Parents may manage health information for children using our "On Behalf Of" feature. See our Terms of Service for complete eligibility requirements.
👉 Translation: Parents can manage family info using our caregiver feature, but no direct accounts for kids under 13.
9Changes to This Policy
We may update this Privacy Policy occasionally. Material changes will be communicated by updating the date above or through app notifications.
10Contact Us
Email: legal@alcottai.com
Website: www.alcottai.com
👉 Translation: Real humans are behind this — reach out anytime.