Privacy Policy

1. Overview

This Privacy Policy explains how Arthur Analytics ("Arthur," "we," "us") collects, uses, and protects information when hospitals and health systems ("Customers") use our AI-powered analytics platform (the "Service"), and when visitors use our website.

2. Information we collect

• Account information: names, work email addresses, and roles of the people your hospital authorizes to use the Service.
• Customer Data: operational and clinical data your systems send to Arthur, such as EHR, billing, and staffing records, for the purpose of generating analytics.
• Website data: information submitted through forms on our website, like a work email address entered to request a demo.
• Usage data: log and device information generated when you interact with the Service, used to keep it secure and working properly.

3. Health information

Where Customer Data includes protected health information (PHI), Arthur handles it in accordance with the Business Associate Agreement (BAA) signed with your hospital and applicable HIPAA requirements, not as a general-purpose data source. We do not sell PHI, and we do not use PHI to train models shared across customers unless your BAA specifically permits it.

4. How we use information

We use the information above to: provide and operate the Service; generate the dashboards and AI-assisted findings your hospital requests; respond to demo requests and support questions; maintain the security and reliability of the Service; and meet legal and contractual obligations.

5. How we share information

We don't sell personal information or Customer Data. We may share information with:

• Service providers who help us run the Service (such as cloud hosting), bound by confidentiality and, where relevant, a BAA.
• Professional advisors, regulators, or authorities where required by law.
• A successor entity in the event of a merger, acquisition, or asset sale, with notice to affected Customers.

6. Security

We use administrative, technical, and physical safeguards designed to protect Customer Data, including encryption in transit and at rest, access controls, and monitoring. No system is completely secure, and we'll notify affected Customers of a confirmed data breach as required by law and by their BAA.

7. Data retention

We retain Customer Data for as long as your subscription is active and for a limited period afterward to allow for export, unless a shorter or longer period is required by your agreement or by law. You can request earlier deletion, subject to any legal retention obligations.

8. Your choices & rights

Hospital administrators can request access to, correction of, or deletion of account information by contacting us. Because clinical and operational data is generally controlled by the hospital Customer rather than Arthur directly, individual requests about PHI should typically go through your hospital's own privacy office in the first instance.

9. Cookies

Our website uses a small number of cookies for basic functionality and to understand aggregate site usage. You can control cookies through your browser settings.

10. Children's privacy

The Service is intended for use by hospital and health system professionals, not by children, and we don't knowingly collect personal information directly from children through our website.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify account administrators by email or in-product notice before the changes take effect.

12. Contact

Questions about this policy or your data can be sent to privacy@arthuranalytics.org.