Privacy Policy
At Berries Health Inc. and its affiliated companies ("Berries", "we," "us," or "our"), your privacy matters to us. This Privacy Policy outlines how we collect, use, disclose, and protect your personal information when you interact with our platform, including our website, mobile application, and related services (collectively, the “Services”). It also reflects our commitment to privacy, as outlined in our Security Page.
Please read this Privacy Policy carefully to understand our policies and practices regarding your personal information. By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. This Privacy Policy is incorporated into and subject to our Terms of Use. Where applicable (including Customers and Authorized Users), users are solely responsible for ensuring that they have obtained all necessary consents, authorizations, and legal permissions to upload, record and process personal and health-related data through the Services.
1. User Classification and Agreement to Terms
This Privacy Policy applies to:
Visitors: Individuals browsing our publicly available website.
Customers: Registered users of the Berries platform.
Authorized Users: Individuals authorized by Customers to use our platform.
Patient Users: patients and their personal representatives who use the patient portal or receive communications through the Services.
1A. Our Role With Patient Information
Berries provides its Services to healthcare providers. When we process information about a provider's patients, including through Practice Management Services, AI documentation tools, and the patient portal (“Patient Information”), we do so strictly on behalf of the provider, as its “Business Associate” under HIPAA or its service provider or processor under other laws. The provider's Notice of Privacy Practices, our Business Associate Agreement with the provider and applicable law govern Patient Information, and this Privacy Policy does not reduce those protections. Patients should direct requests to access, correct or delete their information to their provider. We forward requests we receive directly to the provider.
1B. Practice Management Services and the Patient Portal
Information from Patient Users: When a Patient User uses the patient portal, we collect login credentials, contact details, device and log information, and the information the Patient User submits, such as forms, messages, signatures and payment details. We use it to provide the portal on the provider's behalf, to secure accounts and to meet legal obligations.
No advertising technology: We do not use advertising, remarketing or similar tracking technologies, or share information with advertising partners, in the Berries application, the patient portal, or pages where patients book appointments, complete forms or make payments. The marketing tools described in Sections 4 and 10 apply only to our public website.
Payment information: Card and bank details are collected and processed by our payment processor, Stripe, and are not stored by Berries.
Text messages: We use mobile numbers only to send the messages the user or the provider requested. We do not share mobile numbers or text-message opt-in data with third parties or affiliates for marketing or promotional purposes.
Google data: Berries' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
2. Notice at Collection of Personal Information
Under applicable US privacy laws, such as the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), relevant individuals have the right to know what personal information we collect at or before the time of collection.
Categories of Personal Information Collected:
Identifiers: Name, email address, IP address, unique personal identifier, date of birth (DOB), Social Security Number (SSN), and insurance details.
Commercial Information: Records of services purchased or considered, and transaction history.
Professional or Employment-Related Information: Business contact details and role information for Customers and Authorized Users.
Sensitive Personal Information: Health data processed for generating session notes, medical history, and insurance identifiers, as well as account login credentials in combination with any required access details.
Internet or Other Electronic Network Activity: Device information, cookies, and browsing and usage patterns on our Services.
Patient Information, including the Social Security Numbers, insurance details and health information listed above, is processed on behalf of providers. Protected health information governed by HIPAA and medical information governed by California's Confidentiality of Medical Information Act are exempt from the CCPA, and the CCPA rights described in this Policy do not apply to that information.
Purposes for Collection:
To provide and improve our services.
To manage customer accounts, process transactions, and provide customer support.
To analyze platform usage and trends.
To detect security incidents, verify identities, and protect against fraudulent or illegal activity.
To comply with legal obligations.
Sale and Sharing of Personal Information:
We do not sell personal information or share it for cross-context behavioral advertising. We do not use or disclose Sensitive Personal Information for purposes other than those permitted under California law.
Data Retention Criteria:
We retain each category of personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, satisfy business requirements, resolve disputes, and comply with legal or regulatory obligations, in accordance with Section 8 of this Policy.
3. HIPAA Compliance
Berries meets the relevant requirements under the Health Insurance Portability and Accountability Act (HIPAA) and acts as a Business Associate to covered healthcare providers. We process Protected Health Information (PHI) under strict security measures and subject to our Business Associate Agreement (BAA):
Encryption: PHI is encrypted both at rest and in transit.
Access Control: Access to PHI is restricted to authorized users and personnel on a need-to-know basis.
Administrative, Technical, and Physical Safeguards: We implement safeguards designed to protect PHI in accordance with HIPAA Security Rule requirements.
Breach Notification: In the event of a breach of unsecured PHI, we will notify the affected healthcare provider in accordance with HIPAA regulations and the applicable BAA.
For clarity, PHI includes insurance details, Social Security Numbers, related patient identifiers, session transcripts, clinical notes, diagnosis codes, treatment plans, billing-related documentation, and other health-related content processed through our Services.
No AI Model Training on PHI: We do not use identifiable PHI to train generalized or third-party artificial intelligence models
We do not store audio recordings of sessions. Audio data is processed transiently for the purpose of generating transcripts and related outputs and is not retained following processing, except as required for limited technical troubleshooting or legal compliance.
For HIPAA-related inquiries or to request a copy of our BAA, email help@heyberries.com.
4. How We Use Personal Data
We use personal data for the following specific purposes:
Service Delivery: To provide, maintain, improve, and support our platform and Services.
Documentation: To analyze session content and generate or suggest documentation elements, including potential diagnosis codes, treatment plans, patient instructions, post-session letters, insurance-support documentation, treatment-related classifications, billing codes, and claim-related information.
Pre-Session and Contextual Features: To generate summaries or highlights of prior sessions to assist providers in preparing for upcoming sessions.
AI Chat Assistant: To provide an AI-based chat assistant that may access relevant prior session context to respond to user inquiries, generate clinical or administrative support content, and assist with documentation-related questions. The AI Chat Assistant may analyze content from prior sessions and related documentation to generate contextual responses. The assistant is designed as a support tool for authorized healthcare professionals and does not replace independent clinical judgment. All clinical, diagnostic, treatment, prescribing and billing decisions remain solely the responsibility of the healthcare provider. For clarity, the AI Chat Assistant may access session transcripts, notes, and related documentation to generate contextual responses. This processing occurs in real time and is limited to supporting authorized users in documentation and workflow tasks.
Analytics: To understand user behavior and enhance platform functionality and user experience.
Business Transfers: In connection with evaluating or conducting corporate transactions, with appropriate safeguards.
Legal Compliance: To meet legal and regulatory obligations and respond to claims.
Artificial Intelligence and Machine Learning:
We use artificial intelligence technologies to analyze session data and generate outputs. These systems may process session transcripts, notes, and related documentation. We strictly do not use identifiable Protected Health Information (PHI) or Customer confidential clinical data to train generalized, public, or third-party artificial intelligence models. Where data is used for internal service improvement purposes, it is fully de-identified or aggregated in accordance with HIPAA standards.
Where data is used for analytics or service improvement, it is processed in de-identified or aggregated form in accordance with applicable legal standards.
Marketing and Tracking Technologies (Public Website Only): The marketing and tracking tools described below apply strictly and exclusively to our publicly accessible marketing website and are not deployed within the authenticated Berries application or patient portal.
Our use of Google marketing services and features - including the Google Display Network, YouTube Ads, Google Ads, the Google Ads Enhanced Conversions feature, and Google Remarketing - is subject to Google’s relevant policies and agreements, and users have the option to opt out via the relevant web pages. You can read more about Google’s terms and privacy practices at https://policies.google.com/. We also use analytics tools such as Google Analytics and Google Analytics 4 (GA4) to improve our website and services. For more information about how Google collects and processes data, visit https://policies.google.com/technologies/partner-sites and https://policies.google.com/privacy?hl=en-US. You can opt out of Google Analytics Advertising Features at https://optout.networkadvertising.org/?c=1 and https://tools.google.com/dlpage/gaoptout.
Meta
Our use of Facebook marketing services and features is subject to Facebook’s relevant policies and agreements, including Facebook’s Data Policy (www.facebook.com/policy.php?ref=pf), and users have the option to opt out via the relevant Help Center page (www.facebook.com/help/568137493302217). We also use Instagram marketing services, and their privacy policies and related information are available at https://help.instagram.com/search/?helpref=search&query=privacy%20policy and https://help.instagram.com/155833707900388.
Our use of LinkedIn marketing services and features – including LinkedIn Ads – is subject to LinkedIn’s relevant policies and agreements. LinkedIn may collect or receive information from our website and use it to provide measurement services and ad targeting. Users can learn more about LinkedIn’s data practices at https://www.linkedin.com/legal/privacy-policy and manage their ad preferences or opt out via https://www.linkedin.com/help/lms/answer/a427551 and https://www.linkedin.com/help/lms/answer/a420552.
5. What Personal Data We Collect
We collect the following types of personal data to provide our services effectively:
Account Information: Contact details for account creation.
Health Information: Session transcripts (based on recordings), medical notes, treatment plans, diagnosis codes, billing-related documentation, insurance-support materials, pre-session summaries, patient instructions, post-session letters, and related clinical content processed to generate documentation outputs. This information is accessible only to authorized users. In addition, relevant patients’ information such as name, date of birth, insurance details, Social Security Number, and other identifiers as provided by our users in connection with services. AI Assistant: by default, transcripts and draft notes are deleted after 30 days unless the user changes the retention settings. Practice Management Services: records are retained for the retention period set out in our Terms of Use, unless the provider instructs earlier deletion where permitted by law. Team accounts: if you use Berries as part of a team account, your account administrator can access your notes, except for notes designated as psychotherapy notes. Your administrator can access your transcripts only if you opt in, and you may withdraw your opt-in at any time in your account settings.
Audio Data: Audio recordings are processed transiently and are not retained after processing, except where required for limited technical troubleshooting or legal obligations.
Activity Data: User interactions within the platform (e.g., tags, bookmarks).
Location Data: When you share your location.
Analytics Data: Usage patterns collected via cookies.
Feedback: Emails and communications you send us.
De-identified Data: Aggregated data for research and improvement purposes.
Categories of Personal Information Collected in the Last 12 Months:
Identifiers: Name, date of birth, email address, IP address, Social Security Number, insurance details, and account login details.
Sensitive Personal Information: Health data for session notes and transcripts.
Internet or Other Electronic Network Activity: Device information, cookies, and browsing activity on our platform.
Commercial Information: Records of purchases or services requested.
Professional or Employment-Related Information: Business contact details, professional title, and practice details for Customers and Authorized Users.
Geolocation Data: Location data shared with consent.
Audio Data: Audio recordings processed into transcripts.
Inferences: Preferences derived from usage data.
Categories of Personal Information Disclosed in the Last 12 Months:
We disclosed the above categories of information to service providers, business partners, and authorized users for business purposes.
Categories of Personal Information Sold or Shared in the Last 12 Months:
We do not sell personal information or share it for cross-context behavioral advertising.
Your Rights Under the CCPA/CPRA
Patient Information, including the Social Security Numbers, insurance details and health information listed above, is processed on behalf of providers. Protected health information governed by HIPAA and medical information governed by California's Confidentiality of Medical Information Act (CMIA) are exempt from the CCPA, and the CCPA rights described in this Policy do not apply to that information.
California residents have the right to:
Request access to the specific pieces of personal information collected about them in the last 12 months.
Request information about the categories of personal information collected, disclosed, or sold.
Request the deletion of personal information, subject to legal exceptions.
Opt-out of the sale or sharing of personal information.
Limit the use of sensitive personal information.
Request access to the specific pieces of personal information collected about them in the last 12 months.
Request information about the categories of personal information collected, disclosed, or sold.
Request the correction of inaccurate personal information.
Request the deletion of personal information, subject to legal exceptions.
Opt-out of the sale or sharing of personal information.
Limit the use of sensitive personal information, though we do not use or disclose sensitive personal information for purposes that trigger this right.
though we do not use or disclose sensitive personal information for purposes that trigger this right.
To exercise your rights, email help@heyberries.com. You may also designate an authorized agent to submit requests on your behalf, subject to verification of the agent’s authority and your identity.
Nevada Residents
Nevada residents may opt-out of the sale of personal information. While we do not sell personal data as defined under Nevada law, you can submit a request via help@heyberries.com.
Virginia, Colorado, and Connecticut Residents
Residents of Virginia, Colorado, and Connecticut (and other states with comprehensive privacy laws) have similar rights, including the right to:
Access personal information.
Correct inaccuracies in personal information.
Delete personal information, subject to legal exceptions.
Obtain a copy of personal information in a portable format.
Opt-out of processing for targeted advertising or sales.
Exercise these rights without discriminatory treatment.
Appeals Process:
If we decline to act on your request, you have the right to appeal our decision by contacting us at help@heyberries.com. If your appeal is denied, you may contact your state Attorney General to submit a complaint.
To exercise your rights, email help@heyberries.com.
General State Privacy Rights
As privacy laws evolve, residents of other states may also have additional rights regarding their personal information. These state privacy rights do not apply to Protected Health Information (PHI) processed under HIPAA or clinical records maintained on behalf of healthcare providers. To learn more or exercise your rights, email help@heyberries.com, and we will respond in accordance with applicable laws.
6. How Do We Secure Personal Data?
We implement appropriate technical, administrative, and physical measures designed to safeguard personal data related to you:
Encryption: Personal data is encrypted both in transit and at rest.
Access Control: Access is restricted to authorized personnel only on a need-to-know basis and subject to strict confidentiality obligations.
Regular Security Audits: Systems are routinely assessed for vulnerabilities and security controls.
Secure Mobile Application Controls: Our mobile application implements authentication and security measures designed to protect personal data accessed via mobile devices.
Please note that no method of transmission over the Internet or method of electronic storage is completely secure. While we strive to use commercially reasonable means to protect your personal data, we cannot guarantee its absolute security.
If a breach affects Patient Information, we will notify the affected provider as required by law and our agreement with the provider (including the Business Associate Agreement). For other personal data, we will notify affected individuals as required by applicable law.
7. Do We Transfer Personal Data Outside Your Territory?
Yes, we may transfer personal data related to you to countries outside your jurisdiction to operate and provide services and comply with legal obligations. This may include processing by third-party service providers located outside your jurisdiction, including AI and cloud infrastructure providers.
Our hosting servers are in the United States. By accessing or using our Services, you acknowledge that your personal information may be transferred to, stored, and processed in the United States and other jurisdictions where privacy laws may not be as comprehensive as those in your home country.
Where required by law, we ensure such transfers comply with legal frameworks and maintain appropriate safeguards.
Patient Information (including all Protected Health Information and session documentation) stored in the Practice Management Services or processed through the Services, including backups, is stored exclusively in the United States.
8. For How Long Do We Retain Personal Data?
We retain personal data only for as long as reasonably necessary to:
Fulfill the purposes described in this Privacy Policy and our Terms of Use.
Comply with applicable legal, statutory, tax, accounting, or regulatory obligations.
Resolve disputes and enforce our legal agreements and policies.
Specific Retention Criteria:
AI Documentation & Drafts: Session transcripts and draft notes generated by the AI Assistant are retained in accordance with user account settings (and are deleted after thirty (30) days by default, unless configured otherwise). Audio recordings processed during a session are deleted immediately after transcription and are not retained.
Practice Management Records: Patient Information and finalized clinical Records maintained in the Practice Management Services are retained for ten (10) years following the date of the last record entry, or as otherwise instructed by the healthcare provider or required by law, as set forth in Chapter R of our Terms of Use.
Customer Account Data: Account information, business contact details, and commercial transaction records are retained for the duration of the customer relationship and for a commercially reasonable period thereafter to comply with audit, tax, and legal hold requirements.
Website & Analytics Data: Log files and analytics data collected from visitors to our public website are retained for limited periods sufficient to perform security monitoring and usage analysis.
We implement role-based access controls and audit logging where applicable to monitor access to sensitive data during the retention period.
When personal data is no longer needed, we securely delete or anonymize it in accordance with industry standards.
9. With Whom Do We Share Personal Data?
We share personal data with the following categories of recipients:
Service Providers: Third-party vendors and contractors who perform services on our behalf, including technical infrastructure, cloud hosting, analytics, payment processing (e.g., Stripe), and AI processing services, under written agreements requiring them to protect the confidentiality and security of personal data.
Authorized Users: Healthcare professionals accessing session notes and Records in accordance with their designated account permissions.
Business Transfers and Affiliates: Potential or actual purchasers, investors, or advisors in connection with a corporate merger, acquisition, financing, restructuring, or sale of assets, with appropriate confidentiality protections.
Government Authorities: Regulatory bodies, law enforcement agencies, or other governmental entities as required by law.
We do not sell personal data.
10. Cookies and Tracking Technologies
This Section applies strictly and exclusively to our public marketing website. We use cookies and similar tracking technologies (such as web beacons and pixels) to enhance your experience and analyze usage patterns. Cookies allow us to:
Recognize your browser or device.
Provide personalized features and content.
Track site usage to improve functionality and measure our marketing campaigns.
You can manage cookie preferences through browser settings (and, on our website, through our cookie consent management tool as well), but some features may not work if cookies are disabled. Our website is also configured to recognize and honor universal opt-out preference signals, such as the Global Privacy Control (GPC), sent by your browser.
In addition, when you visit our public website, cookies and similar technologies may be used by our online data partners or service providers to associate your activity with other personal information they (or others) may have about you - such as your email address or online profiles. We (or our service providers) may then use this information to send marketing communications to those emails or profiles. You may opt out of this type of advertising by visiting: https://app.retention.com/optout or by submitting an opt-out request through our cookie banner.
11. Protection of Minors
Our Services for providers are intended exclusively for users aged 18 or older. Providers may use the Services to maintain records of patients who are minors, and a minor patient or the minor's parent or guardian may use the patient portal as permitted by the provider and applicable law. Children under 13 may not create their own portal account. Patient Information about minors is handled strictly on behalf of the provider as described in Section 1A.
Under the CCPA/CPRA, we do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.
12. Privacy Policy Changes
We may update this Privacy Policy periodically to reflect changes in our legal obligations, technology, or business practices. Changes will be posted on our website with an updated “Last Updated” date. If we make material changes to how we process your personal data, we will provide you with reasonable advance notice, such as by sending an email notification to the address associated with your account or by posting a prominent notice on our platform prior to the change becoming effective, Your continued use of our Services after the effective date of the revised Privacy Policy constitutes your acknowledgment of the updated terms.
Contact Us
For questions or concerns, email us at help@heyberries.com.