Privacy policy

Who we are

This policy is from Anatomia, an Entropy & Co company ("Anatomia", "we", "us"). It covers two things: this website, anatomia.health, and the Anatomia product that clinics use at app.anatomia.health.

The two handle information very differently. The website collects almost nothing. The product handles patient information for clinics, under rules set by HIPAA and by each clinic's agreement with us.

This website

The website is a set of static pages. Reading it tells us nothing about you.

• It sets no cookies.
• It runs no analytics, ads or tracking pixels.
• It loads no scripts from other companies. Its fonts are served from our own host.

Our host, Amazon Web Services, keeps standard server logs. These can hold your IP address, the page asked for, the time and your browser's description of itself. We use them only to run and secure the site.

When you write to us

The Contact and Book a demo forms send what you type to our team by email. That is your name, email address, organization, role and message. The demo form also asks which EHR you use and the size of your practice.

The message goes to hello@anatomia.health or demo@anatomia.health through Amazon Simple Email Service. The website does not store it in a database.

To stop automated spam, the server holds your IP address in memory for a short time to limit how often one address can send. A hidden field also catches bots. Neither is kept after the limit resets.

Please don't put patient information in these forms. They are for questions about Anatomia, not for care.

How we use what you send

We use what you send through the website only to:

• answer your question or arrange the demo you asked for;
• follow up about Anatomia, if you asked us to talk;
• keep a record of our correspondence with you.

We keep these emails for as long as we are in touch with you, and for up to two years after our last exchange. You can ask us to delete them sooner.

The product and patient information

Clinics use Anatomia to triage patient calls and follow up with patients. The clinic is the covered entity under HIPAA. Anatomia is the clinic's business associate.

We handle protected health information only under a business associate agreement signed with each clinic, before its first real patient. That agreement and HIPAA govern patient information. Where they differ from this policy, they control. Patients with questions about their records should contact their clinic first.

What the product holds for a clinic

• Calls and their transcripts, and the cases they become.
• Triage, notes, the doctor's sign-off and the callback.
• Chart information read from the clinic's EHR. Connections to Oracle Health, Epic and athenahealth are read-only. Anatomia never writes to the EHR.
• Post-op follow-up questions and the patient's answers.
• Each patient's consent to be contacted, by channel.

Messages to patients

A text or email to a patient says only that the care team has something for them, with a link. It never says anything about their care. The link opens a secure page that asks for a one-time code and the patient's date of birth. Links last seven days and the clinic can revoke them. A patient who replies STOP to a text is never texted again.

Staff accounts

For each clinic staff member we hold their name, email address, role and clinic. We also keep records of sign-ins, failed sign-ins and changes to their second factor.

Every staff member signs in with a second factor. When a password is set, we check it against known breaches. Only the first five characters of the password's hash leave our servers for that check, never the password or the email address.

AI and your data

Anatomia uses AI to suggest a priority, likely causes and cited protocols, and to draft handoffs and patient messages. A nurse or doctor reviews every suggestion and makes the decision.

For patient information, this runs on Amazon Bedrock, using Anthropic's Claude models, and only once our business associate agreement with AWS is in place. Neither Amazon nor Anthropic trains models on what we send, and Bedrock does not share it with Anthropic.

Who we share it with

We do not sell personal information. We do not use it for advertising.

We share it only with the service providers that run Anatomia for us, and only what each needs. The list, and what each one does, is on our subprocessors page. Any provider that handles patient information does so only once a business associate agreement with it is in place.

We may also disclose information when the law requires it, or to protect someone's safety or our rights. For patient information, we do this only as HIPAA and the clinic's agreement allow.

How we protect it

• Anatomia is built to encrypt data in transit with TLS and at rest with keys held in AWS.
• Each clinic's records are kept apart from every other clinic's.
• Staff see only what their role needs.
• An append-only audit log records every time patient information is read, changed or exported, and who did it.
• Error reports leave the product only with patient information removed, and only for a provider under a business associate agreement.

More detail is on our Security & HIPAA page.

How long we keep it

Each clinic sets how long its records are kept. The product never deletes clinical records on its own. Records past the clinic's period are listed for review, and disposal is the clinic's decision. A legal hold stops review of the records it names.

Our security log, which records sign-in problems not tied to a clinic, is kept for six years. Website emails are kept as described above.

If something goes wrong

If we discover a breach of patient information, we tell the affected clinic without unreasonable delay, and no later than 60 days after we discover it. A clinic's agreement may set a shorter time. The clinic then notifies patients as HIPAA requires.

Your choices and rights

If you wrote to us through the website, you can ask to see, correct or delete what you sent. Write to privacy@anatomia.health and we will answer within 30 days.

Depending on where you live, state law may give you further rights. We will honor them for information we control.

Patients have rights over their health records under HIPAA. Those requests go to the clinic, which can use Anatomia to release a copy of a record. If you send one to us, we pass it to your clinic.

Children

The website is for clinics and their staff. It is not meant for children, and we do not knowingly collect information from them through it. Clinics may care for children, and their records are handled as patient information under the clinic's agreement.

Changes and contact

We will post any change to this policy here, with a new date at the top. If a change matters to how clinics' information is handled, we tell clinics directly first.

Questions about privacy go to privacy@anatomia.health. Security concerns go to security@anatomia.health.