Do not enter real patient information unless your organization has approved RVUMD for production use and all required agreements and safeguards are in place.
1. Scope
This notice applies to the RVUMD public website and authenticated clinical billing workspace. An institution’s agreement with RVUMD may provide additional or controlling terms for organization-managed accounts and protected health information.
2. Information we process
Public website information
We may receive contact details and message content that you choose to provide. Please do not include patient information in public forms or email.
Account and organization information
This may include name, email, authentication identifiers, role, organization, department, professional profile, security events, and access assignments.
Clinical and billing workflow information
When an approved organization uses RVUMD in production, the service may process patient demographics, dates of service, diagnoses, notes, professional charges, coding decisions, and related audit records as directed by that organization.
Dictation, encounter audio, and scanned documents
When a clinician uses dictation or the ambient scribe, microphone audio — which may include a patient conversation — is transcribed by Amazon Transcribe Medical within the service’s cloud environment; recorded encounter audio and transcription output are deleted once the transcript is retrieved, with a short-retention backstop. Photographed or scanned billing sheets are processed for text extraction; the images are removed from active storage after reading, retained copies expire within a day, and an abandoned import is discarded within an hour. Names, medical record numbers, and dates of birth read from a sheet are stored encrypted, exactly like the same details typed into a visit. Clinicians are responsible for following their organization’s and jurisdiction’s requirements for consent to record a conversation.
Telehealth visits (development preview)
Where telehealth is enabled, booking a visit collects the patient’s name, date of birth, email, phone, location state and reason for the visit; checking in records consent, the patient’s location and a callback number, and any home readings the patient chooses to share. Video and audio travel through Amazon Chime SDK within the service’s cloud environment and are not recorded. If the patient agrees, the ambient documentation assistant transcribes the conversation as described above; if they decline, it does not listen to them. Visit emails contain the time, the clinician and a secure link only.
Technical information
Security and operational logs may include device, browser, network, authentication, request, and error information. We use essential cookies and local storage as described in our Cookie Notice.
3. How information is used
- Provide, secure, maintain, and troubleshoot the service.
- Authenticate users and enforce role and organization access.
- Support encounter, coding, review, reporting, and audit workflows.
- Respond to inquiries and communicate service or security information.
- Meet contractual, legal, safety, and compliance obligations.
- Improve the service using appropriately governed and minimized information.
RVUMD does not sell patient information or use it for targeted advertising.
4. Healthcare organizations and PHI
Healthcare organizations control the records submitted through their accounts and determine permitted uses, retention, and user access. Where RVUMD acts as a HIPAA business associate, handling of protected health information is governed by the applicable business associate agreement and customer instructions. Production use should not begin until those arrangements are complete.
5. AI-assisted features
Documentation support is decision support, not autonomous clinical or billing action. Identifiers should be minimized before model processing, model output requires human review, and no suggestion should be added unless it is accurate and supported by work actually performed. Customer agreements and deployed configuration determine which model service may process approved data.
6. Sharing
Information may be shared with authorized users in the applicable organization; vendors that operate the service under contract; professional advisers; authorities when legally required; or a successor in a permitted corporate transaction. Access should be limited to the minimum necessary for the assigned function.
7. Retention and security
Retention depends on the record type, customer instructions, applicable agreements, and legal requirements. RVUMD is designed around access controls, multi-factor authentication, encryption, audit records, and monitored infrastructure. No system can guarantee absolute security.
8. Your choices and rights
You may manage website preferences through the cookie banner. Account users should contact their organization’s administrator for access, correction, export, or deletion requests involving organization-controlled records. Other privacy requests can be initiated through the contact page. Rights vary by location and context.
9. Children
RVUMD is a professional service and is not directed to children. Patient information concerning minors may be processed only through an appropriately authorized healthcare organization workflow.
10. Changes and contact
We may revise this notice as the product, contracts, or legal requirements change. The effective date above will be updated. Contact us through the public contact page without including PHI.
For general federal guidance, see the U.S. Department of Health and Human Services resources on the HIPAA Privacy Rule, business associates, and cloud computing.