Request Wizard Privacy Policy

Effective Date: July 2019

Swellbox is committed to ensuring the privacy of sensitive information we handle on behalf of Client Institutions. Please see below for our privacy policies related to the Record Request Wizard.

1. 1. Information we collect
   
   
   • Completed request forms, including but not limited to email addresses, physical addresses, verified phone numbers, and photo ID images
   • User agent strings (browser and operating system information)
   • IP addresses
   • Date and time of request form submission
   • Usability feedback
2. 2. Handling of PHI
   
   

   PHI captured by the Request Wizard is treated in accordance with HIPAA.
   Swellbox handles PHI according to Standards for Privacy of Individually Identifiable Health Information ("Privacy Rule") and Security Standards Specifications for the Protection of Electronic PHI ("Security Rule"), 45 CFR Parts 160 and 164, promulgated pursuant to the Health Insurance Portability and Accountability Act of 1996, as amended, including those amendments made by the Health Information Technology for Economic and Clinical Health Act ("HITECH") found in Title XIII of the American Recovery and Reinvestment Act of 2009, Public Law 111 005.

   Client Institutions may request a copy of our HIPAA policies by emailing support@swellbox.com. The following privacy statements relate to our handling of non-PHI captured by the Wizard.

3. 3. Handling of anonymized data
   
   

   Anonymized usability feedback may be shared, including in public forums.
   Swellbox receives usability feedback from patients through the Request Wizard. We may choose to share this feedback in public forums. This feedback may be attributed to the Client Institution.

   Anonymized, aggregated usage data may be shared, including in public forums.
   Swellbox may choose to share anonymized, aggregated data from an individual Client Institution with other institutions or in public forums. This information may be attributed to the Client Institution.

4. 4. Contacting us about this policy
   
   

   For any questions regarding this policy, please email hello@swellbox.com.

Chatbot Privacy Policy

Effective Date: July 2019

Swellbox is committed to ensuring the privacy of sensitive information we handle on behalf of Client Institutions. Please see below for our privacy policies related to our College Health Wellness Chatbot ("Swellbot").

1. 1. Information we collect
   
   
   • Text entered into Swellbot by end-users ("User Questions")
   • User Question dates and times
   • IP address for each User Question
   • Response links clicked
2. 2. Handling of Personally-sensitive Health Information
   
   

   Users of Swellbot are instructed not to enter personal health information.
   Swellbot users are instructed not to enter personal health information into Swellbot. The following disclaimer is displayed prominently below the Swellbot entry field:
   NOTE: this chat is not with a real person or through a secure channel, so please do not enter any personal health information. This chatbot is for informational purposes only and is not for medical advice. For urgent medical issues, call 9-1-1.

   Swellbox makes a best effort to identify and delete personally-sensitive information from our server logs.
   Should a student enter personally-sensitive information, Swellbox will make a best effort to identify and delete this information from our server logs. However, this information may remain on third-party platforms incorporated into our product.

   Daily usage reports may contain personally-sensitive information.
   Swellbox does not analyze our logs for personally-sensitive information on a daily basis. If a user enters personally-sensitive information, this may be included in the report sent to the Client Institution.

3. 3. Publishing of institution data
   
   

   Swellbox does not publish user entries in real-time.
   To prevent release of personal health information or identifying information, Swellbox does not auto-publish user entries in any public forums. Information published on our website is first reviewed to ensure that no identifying or personally-sensitive information is published.

   User names and contact information are never published or shared without the Institution's consent.
   Swellbox seeks Client Institution consent before publishing any testimonials or entries from users.

   Swellbox may share Swellbot usage data from a Client Institution, including user entries, with other institutions.
   Swellbox may choose to share usage data, including user entries, with other institutions. User entries with identifying information will never be shared without consent from the Client Institution.

   Upon request, Swellbox can provide all of a Client Institution's usage data to that Client Institution.
   Client Institutions looking to request their data may email support@swellbox.com.

4. 4. Use of third-party platforms
   
   

   Swellbox may use third-party backend platforms as part of our Swellbot tech stack.
   Swellbox reserves the right to incorporate third-party platforms into the Swellbot tech stack in order to perform vital product functions. We will provide Client Institutions with a list of our integrations, and any external privacy policies.

5. 5. Contacting us about this policy
   
   

   For any questions regarding this policy, please email hello@swellbox.com.