Your privacy in the Harbor app

Who provides the app

Harbor Office, Inc. provides Harbor Patient Portal on iOS, Android, and the web. Your treating practice is responsible for your care and clinical records; Harbor processes those records on its behalf under the applicable Business Associate Agreement. This notice explains the patient app and complements Harbor’s full Privacy Policy and your practice’s Notice of Privacy Practices. The business Privacy Policy is not a substitute for your practice’s notice.

Information collected

Depending on the features you use, Harbor receives your name and contact details, patient/account identifiers, appointments, health and intake information, assessment answers, journal and check-in entries, messages, signed forms, insurance details and images, uploaded documents, photographs, video messages and their sound, and billing or payment-status records. Free-text, images and recordings may contain sensitive information you choose to include.

Operational records can include sign-ins, IP addresses, browser/device information, security events, video viewing activity, request failures and performance information. Some of these records are associated with your account or care record; we do not represent all operational data as anonymous.

Video messages and recordings

Where enabled by your practice, patients and clinicians can record or upload video messages with sound and send them through Harbor. Practices can also assign videos from their content library. The recording interface displays recording controls. Selecting Stop & upload sends the recording; selecting an existing video file starts its upload. Follow any recording time limit shown. There is not a separate guaranteed preview-and-approve step after upload.

Sent videos, sound, accompanying text and related metadata are stored for authorized playback and practice communication. They may become part of the clinical record. Record in a private setting and avoid including other people or unnecessary sensitive details. Permission to use a camera or microphone is not permission to record another person or a therapy session.

Camera, microphone, photos and files

The camera and microphone support live telehealth and video-message recording. Camera access can also support photographs of insurance cards or documents you choose to provide. File/photo selection lets you upload selected documents, images or videos; it is not permission to upload your entire library. Device prompts explain access when the operating system requires them. You can deny or revoke permissions in device settings; affected recording, capture or telehealth features may then be unavailable. Revoking a device permission does not erase information already sent.

Live telehealth and receptionist calls are different

Harbor does not offer recording of live therapy sessions. Separately recorded video messages are intentionally retained communications, not recordings of a live visit. Calls to a practice’s AI receptionist are a separate service that may be recorded and transcribed with the call disclosure. These distinctions matter when deciding what to share.

How information is used

Harbor uses information to authenticate access, deliver practice communications and telehealth, store and display records and media, process forms and appointments, support billing and insurance functions, maintain security, troubleshoot and operate the service, and comply with applicable obligations. Access by practice workforce and Harbor personnel is limited by their authorized responsibilities; the app is not an end-to-end encrypted service that excludes Harbor and its service providers from all processing.

AI and automated safety processing

Features may use AI for administrative communications, clinical drafts, summaries or supported safety screening under the practice’s settings and applicable restrictions. Clinical drafts require professional review before adoption. A device permission, privacy notice acknowledgment, or ordinary message does not replace any separate AI consent required for a particular use. Ask your practice about the available consent and opt-out choices; optional AI preferences do not disable every administrative or safety function or erase existing records.

Automated screening can miss a concern or produce a false alert. Do not assume every video, attachment, field or language is screened, or that a message or alert has been received or reviewed. Harbor is not an emergency service and does not guarantee a response time.

Service providers and disclosures

Harbor uses Amazon Web Services for hosting, storage and supported processing. Other services described in the full Privacy Policy support particular functions, including Retell for the receptionist, SignalWire for communications, Paubox for email and Stedi for insurance workflows. This does not mean every provider receives every patient record or video. Applicable agreements and permitted purposes govern processing. Stripe handles payments; Harbor does not store full payment-card numbers and does not treat Stripe as a clinical-record repository.

Information may also be disclosed as authorized by the practice or patient, to fulfill lawful requests or other applicable obligations, and as described in the full Privacy Policy subject to the BAA and applicable law. Harbor does not sell patient information, use patient PHI for advertising, or use patient-app information to track people across other companies’ apps and websites for advertising. These statements do not mean information never passes to a contracted service provider.

Storage and safeguards

Patient records and media are stored in Harbor’s cloud services. Video storage uses encryption at rest, encrypted transport and restricted access; application checks limit access to the appropriate practice, patient and authorized users. Security and relevant access events are recorded, but this notice does not promise that every possible access is logged. No security measure guarantees prevention of every incident.

Backups, retained object versions and audit records are distinct from the visible app record. Removing an item from a screen, revoking a sharing assignment, or closing access does not establish immediate destruction of every stored copy. Downloads or copies on your own device are also subject to your device security and backup settings.

Retention, deletion and access requests

Retention depends on the record type, the practice’s obligations, applicable law, existing agreements and legal holds. There is no single automatic deletion deadline for all patient data. Some archived media may require restoration before it can be accessed. Deleting the app or requesting account closure does not automatically delete a clinical record.

To request account deletion, access, correction, export, or another privacy right, contact your practice or privacy@harboroffice.ai. Harbor will coordinate the request with the responsible practice where necessary, verify identity appropriately, and explain applicable retention requirements or restrictions. Do not email clinical records or identity documents unless a secure process has been arranged. Privacy choices do not waive rights or expand an existing agreement.

Minors and representatives

A practice must establish the patient’s or representative’s authority and applicable consent and confidentiality rules. A parent, guardian or other representative does not automatically have access to every minor’s record. Store age ratings do not establish legal consent or clinical suitability.

Urgent help and communication choices

Video messages and other app communications are not a continuously monitored emergency channel. Do not wait for a reply when urgent help is needed. Call 911 for immediate danger or a medical emergency; call or text 988 for crisis support in the United States. Ask your practice about response hours, alternative contact methods and notification settings. Consider who can see notifications or shared devices.

Changes and contact

Updated September 12, 2026. This clarification describes existing capabilities and does not itself authorize a new use, replace a required consent, amend a signed BAA or remove an existing customer’s notice rights. Material changes remain subject to the full Privacy Policy and applicable notice or consent requirements. Contact Harbor Office, Inc. at privacy@harboroffice.ai for privacy requests or support@harboroffice.ai for app support.