Privacy Policy & Disclosure

Last updated: July 18, 2026

This Privacy Policy & Disclosure explains how PatientPower ("we," "us") accesses, uses, shares, secures, and lets you control your health information when you use the Service at beyondmychart.com. We follow a patient-first model consistent with the CMS Interoperability & Patient Access rule and the principles of the CARIN Alliance Code of Conduct for consumer-facing health apps.

Plain-language summary: Your health information is yours. We access only what you authorize, use it to show and explain your records to you, never sell it, never use it for advertising, and let you export or delete it and revoke access at any time.

Practitioner Care Plans (Case Manager)

When a healthcare practitioner uses PatientPower's Case Manager to create and manage a care plan for you (for example, Nassab Chiropractic), your provider directs how your information is used. In that role, PatientPower acts as a service provider / business associate to your provider, and these principles apply:

No cross-practitioner sharing. Information entered by one practitioner is never visible to, or shared with, another practitioner.
Identifiers we use. To connect you to your provider's plan, we use your name and email address, the care-plan content your practitioner enters (goals, instructions, appointment date), and the progress you log.
HIPAA alignment. Protected health information is encrypted in transit (TLS 1.2+) and at rest (AES-256), with role-based access controls and audit logging. Business Associate Agreements (BAAs) are available for practitioner accounts.
No health details in email. Notification emails contain no PHI — only a secure link to sign in and review your plan.
Practitioner & patient control. Your practitioner may update or delete your care-plan data; you may stop using the app and request deletion at any time.
No AI training on your data. Your individual care-plan data is not used to train or improve AI models.

1. Information We Access

With your explicit authorization, the Service connects to your health system or health plan using standards-based, consent-driven APIs (such as SMART on FHIR) and accesses only the categories you approve, which may include:

Lab results and trends, vital signs
Medications and prescriptions
Conditions/diagnoses, allergies, immunizations
Claims and coverage information (where you connect a health plan)
Basic demographics (name, date of birth) needed to organize your record
Information you enter or upload yourself (e.g., a photo of a lab report)

2. How We Use Your Information

To consolidate your records into one patient-owned place and present them to you in clear, plain language for education and visit preparation.
To provide, maintain, secure, and support the Service for you.
We do not use your health information for advertising or marketing, and we do not sell it.

3. How We Share Your Information

We share…	Only…
With people you choose (a clinician, caregiver)	When you direct it; you can revoke anytime
With service providers that operate the Service	Under contract, only to provide the Service to you
When required by law	To comply with a valid legal obligation

We do not otherwise disclose your health information to third parties, and we never sell it or share it for their independent marketing.

4. Your Consent & Control

Consent first. Before any connected data is shared, you log in at your provider/plan and explicitly authorize the specific information.
Revoke anytime. You can disconnect a source in PatientPower, and you can also revoke the app's access at the source (your provider's or health plan's account/portal settings).
Export & delete. You may export your data or request deletion of your account and information at any time.

5. Data Security

We use reasonable administrative, technical, and physical safeguards — including encryption in transit and access controls — to protect your information. Token exchanges with connected systems occur over secure server-side connections, and credentials/secrets are not exposed to your browser. No method of transmission or storage is 100% secure, but we work to protect your data and to notify affected users of a material breach as required by law.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. When you delete your data or account, we remove it from active systems within a reasonable period, except where retention is required by law.

7. Third-Party Sources

Connected health systems and health plans control their own data and are governed by their own privacy policies. PatientPower accesses only what you authorize from those sources and is not responsible for their practices.

8. Children

The Service is intended for adults and for caregivers acting on behalf of someone they are authorized to assist. It is not directed to children under 13, and we do not knowingly collect their information without appropriate authorization.

9. Your Rights

Depending on where you live, you may have rights to access, correct, export, or delete your information, and to withdraw consent. To exercise these rights, email hugh@atlasbiosys.com.

10. Text Messages & Mobile Information

If you give your healthcare provider your mobile number and consent to text reminders, we use that number only to send you the reminders described in our SMS Consent & Policy. Consent is recorded by your provider before any message can be sent, and a patient who has not consented cannot be texted.

We do not sell, rent, or share mobile phone numbers or SMS consent with third parties, and we do not share them with affiliates or partners for their own marketing purposes. Mobile numbers are never purchased, rented, or imported from third-party sources — every number comes directly from the patient to their own provider.

Text messages contain no diagnoses, laboratory results, medications, appointment dates, or care-plan details. Health information is available only after secure sign-in to the app. Messages are limited to a fixed set of pre-approved templates, and this restriction is enforced automatically in our software rather than by policy alone.

Message frequency is typically one to three messages per week. Message and data rates may apply. Reply STOP to any message to opt out at any time; opt-outs take effect immediately and permanently. Reply HELP for assistance, or turn reminders off in the app. Numbers and consent records are retained only as long as needed to operate the service and to evidence that consent was obtained.

11. Changes to This Policy

We may update this policy; material changes will be reflected by the "Last updated" date and, where appropriate, by notice in the Service.

12. Contact

Questions or requests about your privacy and data? Email hugh@atlasbiosys.com, or reach us through beyondmychart.com.