Privacy Statement

Effective: October 31, 2026

This statement explains how RoundSmarter LLC (operating as “Round Smarter”) handles information when our platform is used by healthcare providers in skilled nursing and long-term acute care settings.

Round Smarter is a HIPAA Business Associate

Round Smarter is a Business Associate as defined by the Health Insurance Portability and Accountability Act (HIPAA). We do not have a direct treatment relationship with patients. We provide our platform to healthcare organizations (the Covered Entities) under written Business Associate Agreements (BAAs) that govern how we may use and disclose Protected Health Information (PHI) on their behalf.

If you are a patient with questions about your health information, please contact the healthcare organization that treats you. Your provider can route privacy-rights requests to us through our BAA process.

Information We Process

Round Smarter processes the following categories of information on behalf of the healthcare organizations that contract with us:

• Clinical data retrieved from PointClickCare via authenticated server-to-server API calls — including patient demographics, diagnoses, medications, vitals, progress notes, laboratory and imaging reports, allergies, coverage, nutrition orders, care plans, and admit/discharge/transfer events.
• Therapy data retrieved from Net Health, where a Facility uses Net Health and directs us to process it — including patient name, therapy type, therapy dates, primary diagnosis, and therapy notes.
• Provider-generated content created within Round Smarter — clinical briefs, SOAP notes, and structured note metadata.
• Provider account information for authorized users of the platform — name, NPI, email, facility assignments, and authentication records.

Microphone and Audio Recordings

The Round Smarter mobile app can record short clinical audio during rounding when a provider chooses to start a recording. Microphone access is used solely for this purpose; the app does not record in the background or without an explicit provider action. Recordings are uploaded to our HIPAA-compliant environment over TLS and processed into provider-reviewed clinical documentation. A recording is deleted from the device once it has been successfully uploaded and persisted server-side, and the server-side audio is retained only as long as needed to produce and confirm the resulting documentation, after which it is deleted. Audio is treated as PHI; it is never used for advertising and never sold.

How We Store and Protect Information

• All clinical data is stored in a HIPAA-compliant environment on Google Cloud Platform.
• Data at rest is encrypted using AES-256. Data in transit is encrypted using TLS 1.2 or higher.
• All API traffic between Round Smarter and PointClickCare requires mutual TLS authentication using a client certificate.
• Access is restricted to authenticated providers, scoped to the facilities they are assigned to.
• We maintain audit logs of read access to PHI.
• Round Smarter operates under Business Associate Agreements with the Covered Entities it serves and with its own subprocessors where applicable.

Retention

Clinical data retrieved from PointClickCare is held under a 90-day rolling retention window per (patient, data type). A record’s last_confirmed_at timestamp is refreshed each time PointClickCare re-emits the same record through a polling cycle or webhook event. Records not refreshed within 90 days are deleted by a daily sweep job. AI-derived clinical summaries follow the same 90-day window.

When a patient is discharged or a facility off-boards from Round Smarter, retained data for the affected scope is purged ahead of the normal sweep.

How We Use Information

We use the information described above strictly to operate the Round Smarter platform on behalf of the Covered Entities we serve — generating clinical briefs and AI-assisted documentation, retrieving the clinical data those tasks require, and providing the authenticated user interface that displays them. We do not sell PHI. We do not use PHI for advertising. Aggregate, fully de-identified statistics derived from platform operation may be used for system improvement and quality monitoring; nothing released externally identifies any individual.

Artificial Intelligence and Your Data

Round Smarter uses artificial intelligence to generate clinical documentation. Three commitments govern how your data relates to the models behind it.

We do not train models on protected health information. Round Smarter does not use PHI to train, retrain, or fine-tune any artificial-intelligence or machine-learning model. This applies to clinical data retrieved from an EHR, audio recordings, transcripts, and generated documentation alike.

Our AI subprocessors do not train on your data. Round Smarter uses third-party language-model and speech-recognition services to generate documentation. Those services are contracted so that content Round Smarter sends them is used only to return a result to us — it is not used to train or improve those vendors’ models, and it is not retained beyond what is needed to process the request.

We do develop our products and AI systems using de-identified data. Round Smarter creates de-identified data in accordance with the HIPAA de-identification standard at 45 C.F.R. § 164.514(b), and uses that de-identified data to operate, analyze, improve, and develop its products, services, and AI systems, and for quality monitoring. Data de-identified to that standard is no longer protected health information under HIPAA — it does not identify, and cannot reasonably be used to identify, any individual, provider, or facility. We create and use de-identified data only as permitted by the Business Associate Agreement with the relevant Covered Entity, and we never externally release anything that identifies any individual.

Sharing

We do not share PHI outside of:

• The Covered Entity that contracted with us
• PointClickCare, when writing back a provider-signed progress note to the patient’s chart in PointClickCare at the provider’s explicit instruction
• The subprocessors named below, each engaged under a Business Associate Agreement to deliver the platform
• Disclosures required by law or by the BAA between Round Smarter and the Covered Entity

Subprocessors

The following third parties may process PHI on Round Smarter’s behalf. All PHI is processed within the United States.

We maintain this list current. Before adding a new subprocessor that will process PHI, we will notify the Covered Entities we serve so they may review the change under the governing BAA.

Provider Rights and Account Information

Authorized providers using Round Smarter may request a copy of their account information, request correction of inaccurate account information, or close their account by emailing admin@roundsmarter.com. Requests related to PHI are handled through the Covered Entity, per the governing BAA.

Security Incidents

In the event of a security incident affecting PHI, Round Smarter will notify the affected Covered Entity in accordance with the terms of the governing BAA and applicable law.

Website Visitors

This section covers roundsmarter.com, our public marketing website. It does not cover the Round Smarter platform, which is described above.

• Analytics. We use Google Analytics and HubSpot to understand how visitors use roundsmarter.com: which pages are viewed, how visitors arrived, their device and approximate location, and which links are clicked. Both set cookies on this site. If you have given us your email address, for example by booking a demonstration, HubSpot may connect your later visits to that address. We do not use these tools for advertising: Google’s advertising features are turned off and we do not share this information with advertising networks. You can block these cookies in your browser settings.
• Fonts are loaded from Google Fonts, and demonstration video is embedded from YouTube in privacy-enhanced mode (youtube-nocookie.com). Loading these assets discloses your IP address and browser information to Google, which acts as an independent controller of that information under its own privacy policy. No cookie is set unless you play the video.
• Booking a demonstration sends you to a HubSpot scheduling page. The name, email address, and any note you provide there are used solely to schedule and hold that meeting.
• Email you send us is used solely to respond to you and is retained in our business email system.
• Our web host records standard server logs, including IP addresses, for security and troubleshooting.

We do not sell or share personal information about website visitors, and we do not use it for cross-context behavioral advertising.

Your Privacy Rights

Residents of California and of other US states with comprehensive privacy laws have rights over personal information about them, including the right to know what we collect, to obtain a copy, to correct it, to delete it, and not to be discriminated against for exercising those rights.

We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act. We have not done so in the preceding twelve months.

To exercise a right, email admin@roundsmarter.com with the subject line “Privacy.” We will verify your request by replying to the email address on file. You may use an authorized agent.

Two important limits:

• PHI is out of scope. Protected health information that Round Smarter processes as a Business Associate is exempt from these state laws and is governed by HIPAA and the Business Associate Agreement with your healthcare provider. Direct those requests to your provider, who will route them to us.
• Provider account information is handled as described under “Provider Rights and Account Information” above.

Children

Round Smarter is a professional tool intended solely for licensed healthcare providers and authorized facility staff. It is not directed to, or intended for use by, children, and we do not knowingly collect personal information directly from anyone under the age of 18. Any information about minors that appears in the platform is patient clinical data processed on behalf of a Covered Entity under a BAA — not information collected from a child user.

Contact

For privacy questions or to report a privacy concern, contact:

Email: admin@roundsmarter.com (subject line: “Privacy”)

Updates to This Statement

We may update this statement as our practices evolve. Material changes will be reflected in the effective date at the top of this page and communicated to the Covered Entities we serve through the BAA process.

Round Smarter — RoundSmarter LLC Effective: October 31, 2026