Consumer Health Data Privacy Policy

This policy explains how Harbor Office, Inc. (“Harbor,” “we”) collects, uses, and shares consumer health data for its own purposes, and how you can exercise your rights. It is written for Washington’s My Health My Data Act (RCW 19.373) and Nevada’s consumer health data law (NRS 603A.400 to 603A.550), and we apply it to everyone, wherever you live.

What this policy does not cover. Therapy practices use Harbor to run their offices. Information about a practice’s patients — charts, intake forms, appointments, messages, and calls to a practice’s phone line — is health information that Harbor handles for that practice under federal health privacy law and the practice’s own privacy notice. If you are a patient of a practice that uses Harbor, contact your practice about your records.

Calls and texts to our demo line. Harbor runs a public demonstration phone line so practices can hear our AI receptionist. Callers often play the part of a new patient. If you call or text it, we collect what you say or type — which can include a reason for seeking care, symptoms, answers to screening questions, or an appointment request — together with your phone number, any name you give, and the call recording and transcript. We ask callers to use made-up details instead of their own health information.

We use this only to give you the demonstration you asked for, to keep the demo line working, and to protect it against fraud and abuse. We do not use it for advertising, and we do not use it to contact you about your health.

Messages you send us. If you include health information in an email to us — for example in a privacy request — we use it only to answer you.

Our website does not ask about your health. Our forms ask about your practice, not about you as a patient. Our own website measurement records the page viewed, the device type, a coarse country and region, and a random browser identifier. We do not use it to identify or infer anyone’s health.

Directly from you, when you call, text, or email us; and from the phone network, which gives us the number you are calling from.

Demo-line calls are answered by our AI receptionist, which processes the conversation as it happens. Recordings, transcripts, and messages are stored in encrypted form. Access is limited to the people and service providers who need it for the purposes above.

We do not sell consumer health data. We do not share it with advertisers, data brokers, affiliates, or any other third party.

Service providers process it for us, only on our instructions and under written contracts. They fall into these categories: cloud hosting and storage; voice and text message transport; the AI receptionist runtime and AI processing; and email. We may also disclose information when the law requires it.

If we ever want to share consumer health data with a third party for another reason, or to use it for a purpose not described here, we will ask for your consent first, and separately. We will never sell it.

No third party collects consumer health data about your online activities over time or across websites through our website or demo line. We do not use geofences or location tracking around places where people receive health care.

You may ask us to:

• Confirm and access — tell you whether we collect, share, or sell your consumer health data, give you a copy, and give you a list of every third party and affiliate we shared it with, with their contact details.
• Delete — delete your consumer health data, including from archives and backups, and tell our service providers to delete it too.
• Withdraw consent or stop — stop collecting or sharing your consumer health data.
• Correct — review information and ask us to change it.

How to ask. Email chance@harboroffice.ai with the subject “Consumer Health Data Request.” You do not need an account. Tell us what you want and how to reach you. For demo-line data, include the phone number you called from and roughly when. We will ask only for what we need to confirm the request is yours. Please do not send identity documents unless we ask.

When we answer. We respond within 45 days of receiving your request. If we need more time, we will tell you why within those 45 days and may take up to 45 more. We delete within 30 days after we confirm a deletion request. Backup copies are removed on their normal cycle and no later than 6 months after we confirm the request. If a legal exception requires us to keep something, we will tell you what and why.

Requests are free at least twice a year. We will not treat you differently, charge you more, or give you a lesser service because you used these rights.

If we decline your request, you can appeal. Email chance@harboroffice.ai with the subject “Consumer Health Data Appeal.” We will review the decision again and answer in writing within 45 days with our reasons. If we deny the appeal, you can contact the Washington State Attorney General at atg.wa.gov or the Nevada Attorney General at ag.nv.gov.

We post every change on this page with a new effective date. Before we collect a new category of consumer health data, use it for a new purpose, or share it with a new kind of recipient, we will tell you and ask for your consent.