Privacy notice.

NOTICE VERSION: 2026-07-18.1 · EFFECTIVE: 2026-07-18

This notice covers phigate.ai. It is short because the site does little. This notice is versioned; the version you accept with a waitlist submission is stored with your record.

What we collect.

If you never sign in, the only data this site collects is the waitlist form. The waitlist form is a closed set of fields with no narrative free-text, and the email address is its only free-entry field. Signing in, and using the inference API, each add records of their own — both are listed below.

• Email address. Required. Validated for shape, capped at 254 characters.
• Role. A selection from a fixed list.
• What you are building. A selection from a fixed list.
• Consent confirmation, recording the version of this notice you were shown.
• A timestamp and a reference ID we generate.

We do not store your IP address in waitlist records. This site runs no analytics and no tracking scripts. It sets one cookie, and only after you sign in: a session cookie. There are no advertising or cross-site tracking cookies. No advertising identifiers.

If you create an account.

An account stores your email address, a salted password hash (never your password), a session cookie, your consent records, and, after checkout, a Stripe customer reference and your seat entitlements. Payments are processed by Stripe; card numbers never touch PHIGate servers.

Account records live in the same private storage as waitlist entries, keyed by a keyed hash of your email, and follow the same deletion procedure: email customerservice@healthit.com from your account address and we remove the account record and cancel any active seat. The session cookie is strictly for keeping you signed in; it is not used for tracking.

If you use the inference API.

If you use the inference API we store a hash of each API key (never the key), the key name, lane, mode and timestamps, and per-period usage counts. Usage records contain no request or response content.

Usage records exist to meter and bill your account, and they record counts, not content: the key, the deployment profile, the lane, token totals and a request total. On the tokenized lane, identifiers we detect are replaced before the request leaves us and restored in the response; the map between the two is held only for the life of that request and is never written down. Deleting your account removes these records on the same procedure as the rest.

Why we collect it.

Waitlist entries are used to contact you about PHIGate access and to understand aggregate demand. Account, API-key and usage records exist to operate the service you signed in for: authenticating you, authorising your keys, and metering and billing your usage. Nothing is used for any other purpose. We do not sell it, share it for marketing, or use it to build profiles.

Where it lives.

Entries are stored in a private storage bucket on Vercel, our hosting platform, accessible to the PHIGate team and the deployment environment only.

Platform disclosure: Vercel processes IP addresses and user agents in its own request and function logs under its retention policies. Those platform logs are separate from our waitlist records. Our application logs record a reference ID, timestamp, and outcome only, never form field values.

How long we keep it.

Waitlist entries are retained for a maximum of 18 months, or until they are migrated into account onboarding if PHIGate access opens sooner, whichever comes first. Retention is verified on a quarterly review cycle.

Deletion.

Email customerservice@healthit.com from the address you submitted and ask for removal. We look the entry up by your normalized email address, delete every stored record that matches it, and log only that a deletion occurred, with a reference ID and timestamp, never the content.

One honest caveat: Submissions arriving at nearly the same moment can create duplicate records; we de-duplicate at review time and a deletion request removes all records matching your email.

If PHI reaches us anyway.

If we become aware that a waitlist entry contains protected health information, we quarantine and delete it within 24 hours of becoming aware, and we keep a sanitized incident record containing no health information. If you believe you submitted PHI, or you see it anywhere on a PHIGate surface, email customerservice@healthit.com immediately.

Contact.

customerservice@healthit.com for anything in this notice: questions, deletion, corrections, or reports. Prior notice versions are available on request.