This Privacy Policy and Notice (“Notice”) explains how Alyf Inc. (“Alyf,” “we,” “us,” or “our”) handles information when you use or access the Alyf services.
“Alyf Service” refers to Alyf websites, software platforms, web and mobile applications, and related technology services.
This Notice is different from any Notice of Privacy Practices issued by your healthcare providers. Those provider notices govern how your providers handle protected health information in delivering care.
HIPAA Status
Alyf works with healthcare providers and health plans that are “covered entities” under the Health Insurance Portability and Accountability Act (“HIPAA”). When Alyf receives protected health information (“PHI”) from or on behalf of covered entities, we act as a HIPAA “business associate” and handle PHI only as permitted by HIPAA and our business associate agreements.
Alyf does not provide medical advice or make clinical determinations. All medical interpretation and decisions are made solely by licensed healthcare providers.
Information We Collect
Depending on your role, we may collect:
Patients: Personal identifiers (such as name and contact information) and health-related information provided by you, your healthcare providers, or their authorized partners.
Clinicians and staff: Professional contact information to support use of the Alyf Service.
Website visitors: Standard usage information (such as browser type, operating system, IP address, and cookies) to operate and improve our Sites.
How We Use Information
We may use your information to:
Provide, maintain, and improve the Alyf Service.
Support healthcare organizations in making information available to their providers.
Communicate with you regarding your account or technical support.
Detect, investigate, and prevent misuse, fraud, or security incidents.
Perform de-identified and/or aggregated analysis to improve the Alyf Service.
If you are a patient receiving care through a covered entity, Alyf uses your PHI solely on behalf of that entity and in accordance with HIPAA and our agreements.
Sharing Information
We may share information with:
Service providers: Vendors that help operate and support the Alyf Service.
Healthcare providers and health plans: Your healthcare providers or health plan if they use Alyf to deliver or coordinate your care.
Legal authorities: As required by law, regulation, or legal process.
Business transactions: In connection with a merger, acquisition, or similar transaction, consistent with this Notice.
Alyf does not sell PHI and does not use PHI for advertising.
Retention
PHI is retained as required by our agreements with covered entities. Other personal information is retained only as long as necessary for the purposes described in this Notice or as required by law.
Security
Alyf maintains administrative, technical, and physical safeguards consistent with HIPAA and SOC 2 Type II standards to protect personal information. While no system can eliminate all risk, we use layered controls to minimize the likelihood of unauthorized access or disclosure.
Electronic Communication Risks
Any internet-connected service carries some risk of unauthorized access. Alyf takes steps to reduce this risk but cannot guarantee it can be eliminated.
Cookies and Analytics
Alyf uses cookies and analytics to operate and improve the Sites and the Alyf Service. These tools do not involve PHI for advertising purposes. You may disable cookies in your browser; some features may not function properly if cookies are disabled.
Your Rights
Depending on your location and applicable law (such as HIPAA, the California Consumer Privacy Act, or the EU General Data Protection Regulation), you may have rights to:
Access or receive a copy of certain personal information.
Request corrections or updates.
Request deletion of certain personal information, subject to legal and contractual obligations.
Restrict or object to certain types of processing.
Receive a copy of your information in a portable format (where applicable).
Requests to exercise these rights may be made by contacting support@alyf.health. If your information is being processed on behalf of your healthcare provider, Alyf will coordinate with that provider as required by law and contract.
International Transfers
If information is transferred outside your home country, Alyf ensures appropriate protections consistent with applicable laws, such as standard contractual clauses or participation in recognized data transfer frameworks.
Children’s Privacy
The Alyf Service is not directed to children under 18, and we do not knowingly collect personal information from them without parental consent.
Changes to This Notice
We may update this Notice periodically. Updates will be posted on the Site or within the Alyf Service. Your continued use after an update indicates acceptance of the revised Notice.
Contact Us
Questions about this Notice can be sent to support@alyf.health.