Privacy Policy

SUMMARY OF KEY TERMS

This summary is provided for convenience and does not form part of, modify, or limit this Privacy Policy. In the event of any inconsistency, the Privacy Policy below controls.

Tandem provides software to Healthcare Organizations. Tandem is a business associate of your Healthcare Organization under HIPAA. Your Healthcare Organization is the covered entity responsible for your protected health information.
Tandem collects information you and your Healthcare Organization provide, including account details, screening responses and scores, in-app activity, and messages, together with device and usage information collected automatically.
Tandem uses this information to operate the Service for you and your care team. Tandem does not sell personal information.
Tandem discloses information to your care team, to service providers under contract, and as required by law.
Tandem and your Healthcare Organization send text messages and emails relating to your account and care. Text messages may be stopped at any time by replying STOP.
Patient records are retained for seven (7) years, including records of individuals who never used the Service or did not qualify for a program.
Your rights to access, amend, and receive an accounting of disclosures of your protected health information, and to file a complaint, are exercised through your Healthcare Organization under its Notice of Privacy Practices.
The Service is available only to individuals eighteen (18) years of age or older.

1. INTRODUCTION AND SCOPE

1.1 This Privacy Policy (this "Policy") describes how Tandem and Community, Inc. ("Tandem," "we," "us," or "our") collects, uses, discloses, retains, and protects information in connection with the Service. Capitalized terms not defined in this Policy have the meanings given in the Tandem Terms of Use.

1.2 This Policy applies to:

(a) Patient Users, being individuals who access Tandem Care at the invitation of a Healthcare Organization, including individuals whose records have been entered into the Service by a Healthcare Organization and who have not yet accessed the Service;
(b) Organizational Users, being individuals who access Tandem Clinical or Practice Hub in the course of employment or engagement by a Healthcare Organization; and
(c) Visitors to beintandem.co.

1.3 This Policy is incorporated by reference into the Terms of Use. By accessing or using the Service, you acknowledge that you have read and understood this Policy.

2. DEFINITIONS

2.1 "Business Associate" and "Covered Entity" have the meanings given in 45 C.F.R. § 160.103.

2.2 "Business Associate Agreement" means the agreement between Tandem and a Healthcare Organization required by 45 C.F.R. § 164.504(e).

2.3 "De-Identified Information" means information that has been de-identified in accordance with 45 C.F.R. § 164.514(b) or that otherwise cannot reasonably be used to identify an individual.

2.3A "Data Use Agreement" means an agreement between Tandem and a Healthcare Organization that satisfies 45 C.F.R. § 164.514(e)(4) and governs Tandem's use of a Limited Data Set.

2.3B "Limited Data Set" means PHI from which the direct identifiers listed in 45 C.F.R. § 164.514(e)(2) have been removed.

2.4 "Personal Information" means information that identifies, relates to, or could reasonably be linked with an identified or identifiable individual.

2.5 "Protected Health Information" or "PHI" has the meaning given in 45 C.F.R. § 160.103.

3. TANDEM'S ROLE UNDER HIPAA

3.1 Business Associate Status. Each Healthcare Organization is a Covered Entity under HIPAA. Tandem acts as a Business Associate of each Healthcare Organization and creates, receives, maintains, and transmits PHI on the Healthcare Organization's behalf pursuant to a Business Associate Agreement. The Business Associate Agreement requires Tandem to safeguard PHI and restricts Tandem's use and disclosure of PHI to those purposes permitted by the Healthcare Organization, by the Business Associate Agreement, and by applicable law.

3.2 Exercise of HIPAA Rights. Because the Healthcare Organization is the Covered Entity, a Patient User's rights under HIPAA with respect to PHI are exercised through the Healthcare Organization. These rights include the right to access and obtain a copy of PHI, to request amendment of PHI, to receive an accounting of disclosures, and to file a complaint. The Healthcare Organization's Notice of Privacy Practices describes these rights and the procedure for exercising them. Requests received by Tandem directly will be referred to the applicable Healthcare Organization, and Tandem will support the Healthcare Organization in responding as required by the Business Associate Agreement.

3.3 Precedence. With respect to PHI, in the event of any conflict between this Policy and the applicable Business Associate Agreement, the Business Associate Agreement controls.

4. INFORMATION WE COLLECT

4.1 Information Provided by Users and Healthcare Organizations.

(a) Account and identity information: name, date of birth, telephone number, email address, preferred language, and, for Organizational Users, employer, role, work contact information, and professional identifiers such as a National Provider Identifier.
(b) Care relationship information: the Healthcare Organization, care team members, and site at which a Patient User receives care.
(c) Screening and clinical information: responses to and scores from screening instruments (including the PHQ-9, GAD-7, and EPDS), whether entered by the Patient User or by a provider; information a Patient User provides regarding life circumstances, stressors, and well-being; and related clinical notes entered by the care team.
(d) Communications: messages exchanged between Patient Users and their care team through the Service.
(e) Consent records: records of consents and acceptances, including consent to text messaging and acceptance of the Terms of Use and this Policy, with version, date, and method.

4.2 Information Collected Automatically.

(a) Device and connection information: device type, operating system, browser type, IP address, and device identifiers.
(b) Usage information: screens and content accessed, features used, activities completed, and the date, time, frequency, and duration of use.
(c) Approximate location derived from IP address.
(d) Communication logs: records of text messages and emails sent by the Service and their delivery status.
(e) Cookies and similar technologies that may be used on beintandem.co, as described in Section 10.5.

4.3 Information Not Collected. Tandem does not collect payment card information from Patient Users. Fees for the Service are paid by Healthcare Organizations through a third-party payment processor; Tandem does not store payment card numbers of Patient Users.

5. HOW WE USE INFORMATION

5.1 Tandem uses Personal Information, including PHI as permitted by the applicable Business Associate Agreement, for the following purposes:

(a) to provide, operate, maintain, and secure the Service, including screening instruments, content, exercises, reminders, messaging, and remote monitoring configured by the Healthcare Organization;
(b) to make screening results, progress, and messages available to the Patient User's care team, and to generate alerts to the care team where a screening response indicates potential risk;
(c) to verify identity, authenticate Users, and deliver one-time verification codes;
(d) to send communications described in Article 7;
(e) to support the Healthcare Organization's billing for care rendered, including remote monitoring services, where applicable;
(f) to operate, troubleshoot, analyze, and improve the Service;
(g) to comply with legal obligations and maintain required records; and
(h) to create De-Identified Information, which Tandem may use for any lawful purpose, including to improve the Service and analyze its use.

5.2 Product Improvement; Artificial Intelligence. Tandem may use De-Identified Information derived from the use of the Service by any category of User, together with usage and device information that does not constitute PHI, to develop, evaluate, train, and improve the Service and its features, including through the use of machine learning and large language model technologies. Such technologies may be operated by Tandem or by service providers under contract with Tandem. Tandem does not use PHI for these purposes except as permitted by the applicable Business Associate Agreement, and does not disclose PHI to any provider of such technologies unless that provider is bound by a business associate agreement with Tandem. Tandem's use of artificial intelligence is further described in Section 5.4.

5.3 Limited Data Sets. Where a Healthcare Organization has entered into a Data Use Agreement with Tandem, Tandem may use a Limited Data Set derived from that Healthcare Organization's PHI for the purposes permitted by 45 C.F.R. § 164.514(e)(3), namely research, public health, and health care operations. The health care operations for which Tandem uses a Limited Data Set are the Healthcare Organization's clinical operations conducted through the Service, including assessing and improving the quality of the Healthcare Organization's screening, follow-up, care coordination, and remote monitoring programs; evaluating the clinical workflows and tools the Healthcare Organization uses within the Service; and improving the Service so that it better supports those programs. Where a use also serves a public health purpose permitted by 45 C.F.R. § 164.512(b), the Data Use Agreement may so provide. Each use is solely as specified in, and subject to the restrictions of, the applicable Data Use Agreement. A Limited Data Set is used only by Tandem and by service providers bound by written agreements that impose the same restrictions, is never sold, and is never used to contact or re-identify any individual. Tandem does not use a Limited Data Set of any Healthcare Organization that has not executed a Data Use Agreement.

5.4 Artificial Intelligence. Tandem uses artificial intelligence tools in its internal business operations, including the product-improvement activities described in Sections 5.2 and 5.3. The Service does not include any artificial intelligence feature that interacts directly with Users. Tandem complies with the Texas Responsible Artificial Intelligence Governance Act (Texas Business and Commerce Code Chapter 551) and with similar state and local laws governing the use of artificial intelligence in healthcare and consumer-facing services, to the extent they apply to Tandem. Should Tandem introduce any artificial intelligence feature that interacts directly with Users, Tandem will, before that feature is made available: (a) update these Terms of Use and this Privacy Policy to describe the feature, the information it uses, and the disclosures required by applicable law; (b) identify the feature to Users as artificial intelligence at the point of interaction; and (c) notify all Users and require acceptance of the updated documents in accordance with Article 14.

6. HOW WE DISCLOSE INFORMATION

6.1 No Sale. Tandem does not sell, rent, license, or lease Personal Information to any third party.

6.2 Permitted Disclosures. Tandem discloses Personal Information only to the following categories of recipients:

(a) Healthcare Organizations and care teams responsible for the Patient User's care, including billing personnel and third-party revenue-cycle partners the Healthcare Organization has authorized to access the Service, who receive PHI on the Healthcare Organization's behalf and are bound by the Healthcare Organization's agreements and policies and by HIPAA;
(b) Service providers that perform functions on Tandem's behalf, subject to written contracts restricting their use of Personal Information and, where PHI is involved, subject to Business Associate Agreements, in the following categories: cloud hosting and storage; text message and email delivery; identity, authentication, and security; analytics and error monitoring; customer support; and payment processing for Healthcare Organizations. A current list of service providers is available upon request to [email protected];
(c) Professional advisors, including legal counsel and accountants, to the extent necessary for the services they render to Tandem;
(d) Governmental authorities and other parties where required by law, legal process, or regulatory obligation, to protect the safety of any person, or to enforce Tandem's agreements; and
(e) Successors in connection with a merger, acquisition, financing, reorganization, or sale of all or substantially all of Tandem's assets, subject to this Policy, the applicable Business Associate Agreement, and applicable law, with notice to affected Healthcare Organizations.

6.3 No Advertising Use. Tandem does not disclose Personal Information to advertisers and does not use PHI for marketing or advertising purposes.

7. ELECTRONIC COMMUNICATIONS

7.1 Program Description. Tandem and Healthcare Organizations send text messages (SMS) and emails to Users concerning accounts, screening instruments, reminders, care, security (including one-time verification codes), and material notices regarding the Service.

7.2 Consent and Withdrawal. Consent to text messages is obtained within the Service. A User may withdraw consent to text messages at any time by replying STOP to any message and may resume messages by replying START. Reply HELP for assistance. Message frequency varies. Message and data rates may apply. Withdrawal of consent to text messages does not affect the User's care.

7.3 Transmission. Text messages are transmitted through a messaging service provider under contract with Tandem. The content of a text message may be accessible to the User's wireless carrier and to any person with access to the User's device.

7.4 Email. Communications regarding accounts and care are a component of the Service. Any marketing email will include an unsubscribe mechanism.

8. DATA RETENTION

8.1 Patient Records. **Tandem retains Patient User records for a period of seven (7) years which may begin from the date of last service or the date of creation of the record. This retention period applies to every Patient User record maintained in the Service, including records of individuals entered into the Service by a Healthcare Organization who never accessed the Service and records of individuals who completed a screening instrument and did not qualify for a program. This retention period reflects medical record retention requirements under applicable state law, payer requirements, and Tandem's obligations to Healthcare Organizations.

8.2 Deletion. Patient User records may not be deleted prior to the expiration of the retention period at the request of a Patient User or a Healthcare Organization. Upon expiration of the retention period, Tandem will evaluate deleting or de-identifying the record.

8.3 Other Information. Account and usage information that does not form part of a patient record is retained only for so long as necessary to operate the Service and satisfy legal obligations. Organizational User information is retained for the duration of the account and for any further period required by the applicable Organization Agreement.

9. SECURITY

9.1 Tandem maintains administrative, technical, and physical safeguards designed to protect Personal Information, including encryption of data in transit and at rest, role-based access controls limiting access to personnel with a need to know, identity verification of Organizational Users, automatic termination of inactive sessions, logging of access to PHI, and periodic review of security practices.

9.2 No method of transmission or storage is entirely secure, and Tandem cannot guarantee the absolute security of Personal Information.

9.3 In the event of a breach of unsecured PHI, Tandem will notify the affected Healthcare Organization as required by HIPAA and the applicable Business Associate Agreement, and the Healthcare Organization will provide notice to affected individuals as required by law.

10. YOUR RIGHTS AND CHOICES

10.1 Protected Health Information. Rights with respect to PHI, including access, amendment, accounting of disclosures, and complaints, are exercised through the Healthcare Organization as described in Section 3.2.

10.2 Account Information. Users may update telephone number, email address, and preferred language within the Service or through the Healthcare Organization.

10.3 Text Messages. Users may withdraw consent at any time by replying STOP, as described in Section 7.2.

10.4 Marketing Email. Users may unsubscribe from marketing email using the mechanism included in each such email.

10.5 Cookies. The website at beintandem.co is a marketing website. Any cookies or similar technologies that may be used on beintandem.co are not linked to any User account, to any Patient User, or to any Organizational User, and do not collect PHI. The Service applications (Tandem Care, Tandem Clinical, and Practice Hub) use only those cookies and browser storage strictly necessary for authentication, session management, and security. Most browsers permit Users to block or delete cookies; blocking necessary cookies in the Service applications will prevent sign-in.

11. RESEARCH AND DE-IDENTIFIED INFORMATION

11.1 Tandem may use De-Identified Information to evaluate the use and effectiveness of the Service and to improve it. Tandem does not use Personal Information that identifies a Patient User for research purposes without the authorization of the applicable Healthcare Organization and any individual authorization or consent required by applicable law.

12. AGE REQUIREMENT

12.1 The Service is available only to individuals eighteen (18) years of age or older. Tandem does not knowingly collect Personal Information from any individual under eighteen (18) years of age. If Tandem becomes aware that it has collected such information, Tandem will delete it to the extent permitted by applicable law and notify the applicable Healthcare Organization.

13. STATE PRIVACY RIGHTS

13.1 Texas. Tandem complies with the Texas Medical Records Privacy Act (Texas Health and Safety Code Chapter 181), which applies to any person that handles protected health information in Texas, including Tandem, and which among other things prohibits the sale of protected health information and requires workforce privacy training. Residents of Texas may also have rights with respect to Personal Information under the Texas Data Privacy and Security Act and other applicable state law. PHI that Tandem maintains as a Business Associate under HIPAA is generally exempt from such laws and is governed by HIPAA, and the retention obligations in Article 8 continue to apply. Requests concerning PHI should be directed to the Healthcare Organization; other requests may be directed to Tandem at [email protected].

13.2 Other Jurisdictions. Tandem currently provides the Service to Healthcare Organizations located in Texas. As Tandem expands the Service to Healthcare Organizations or Users in other states or localities, Tandem will review the privacy, health information, breach notification, and artificial intelligence laws of each new jurisdiction, will update this Policy to describe any additional rights or obligations that apply, and will notify Users and require acceptance of the updated Policy in accordance with Article 14 before or upon the Service becoming available in that jurisdiction.

14. CHANGES TO THIS POLICY

14.1 Each version of this Policy bears a version number and an Effective Date, set forth above. Upon publication of a new version, Users will be required to review and accept the new version at their next sign-in. Superseded versions are available upon request to [email protected].

15. LANGUAGE

15.1 This Policy is made available in English and in Spanish. In the event of any inconsistency between the English and Spanish versions, the English version controls. The Spanish version is provided for convenience.

16. CONTACT

Privacy inquiries and requests:
Tandem and Community, Inc.
The Woodlands, TX 77382
[email protected]

Requests concerning Protected Health Information and HIPAA rights should be directed to your Healthcare Organization.