Privacy Policy

heme (“heme,” “we,” “us”) is an electronic health record platform for independent medical practices, operated by Tacit Investments, LLC. This policy describes how we collect, use, and protect information on hemeehr.com and in the heme application.

Patient medical records are different

Patient health information stored in heme is entered and controlled by medical practices, who are the covered entities under HIPAA. heme processes that information solely as a business associate, under a Business Associate Agreement with each practice. We do not use patient health information for any purpose other than providing the service, we do not sell it, and we do not use it to train third-party AI models. If you are a patient, requests about your medical records should go to your practice, which controls them.

Information we collect

• Account information — name, email address, role, professional identifiers (such as NPI), and credentials for practice staff who use heme.
• Practice information — practice name, address, tax identifiers, and billing configuration needed to operate the service.
• Usage and log data — access logs, audit trails, and technical data (IP address, browser type) generated by use of the service. Audit logging of access to patient records is a HIPAA requirement, not optional telemetry.
• Payment information — subscription and patient-statement payments are processed by Stripe. Card and bank numbers go directly to Stripe; heme never stores them.
• Contact submissions — email addresses submitted through our waitlist or contact forms.

How we use information

• To provide, secure, and support the service.
• To bill subscriptions and, on behalf of practices, patient statements.
• To provide AI-assisted features (documentation drafting, coding suggestions, appeal drafting). AI output is always draft-only: a licensed professional reviews and approves before anything is filed.
• To meet legal, audit, and security obligations.

We do not sell personal information, and we do not run third-party advertising or trackers.

Sharing

We share information only with service providers needed to operate heme — cloud hosting, payment processing (Stripe), claims clearinghouse, email delivery, and AI processing — each bound by contract, and by Business Associate Agreements where they handle patient health information; and where required by law.

Security

Data is encrypted in transit and at rest. Access is role-based and audited. Each practice's records are isolated. No system is perfectly secure, but security is engineered into heme as a clinical system, not added afterward.

Retention

Practice and patient records are retained for as long as the practice’s subscription is active and thereafter as required by medical-records retention law. Practices can export their data in standard formats (FHIR R4).

Your choices

Practice users may access and correct their account information in the application. You may request access, correction, or deletion of your personal information by writing to support@hemeehr.com. Deletion requests cannot override medical-records retention obligations that apply to practices.

Cookies

heme uses essential cookies only: session authentication and a saved theme preference. There are no advertising or cross-site tracking cookies.

Children

Our websites and accounts are not directed to children. Pediatric patient records within heme are governed by the practice relationship and HIPAA, as described above.

Changes

We will post any changes to this policy on this page with a new effective date, and notify practices of material changes.