Effective: July 31, 2026
This statement explains how RoundSmarter LLC (operating as “Round
Smarter”) handles information when our platform is used by healthcare
providers in skilled nursing and long-term acute care settings.
Round Smarter is a
HIPAA Business Associate
Round Smarter is a Business Associate as defined by the Health
Insurance Portability and Accountability Act (HIPAA). We do not have a
direct treatment relationship with patients. We provide our platform to
healthcare organizations (the Covered Entities) under written Business
Associate Agreements (BAAs) that govern how we may use and disclose
Protected Health Information (PHI) on their behalf.
If you are a patient with questions about your health information,
please contact the healthcare organization that treats you. Your
provider can route privacy-rights requests to us through our BAA
process.
Information We Process
Round Smarter processes the following categories of information on
behalf of the healthcare organizations that contract with us:
- Clinical data retrieved from PointClickCare via
authenticated server-to-server API calls — including patient
demographics, diagnoses, medications, vitals, progress notes, laboratory
and imaging reports, allergies, coverage, nutrition orders, care plans,
and admit/discharge/transfer events. - Therapy data retrieved from Net Health, where a
Facility uses Net Health and directs us to process it — including
patient name, therapy type, therapy dates, primary diagnosis, and
therapy notes. - Provider-generated content created within Round
Smarter — clinical briefs, SOAP notes, and structured note
metadata. - Provider account information for authorized users
of the platform — name, NPI, email, facility assignments, and
authentication records.
Microphone and Audio
Recordings
The Round Smarter mobile app can record short clinical audio during
rounding when a provider chooses to start a recording. Microphone access
is used solely for this purpose; the app does not record in the
background or without an explicit provider action. Recordings are
uploaded to our HIPAA-compliant environment over TLS and processed into
provider-reviewed clinical documentation. A recording is deleted from
the device once it has been successfully uploaded and persisted
server-side, and the server-side audio is retained only as long as
needed to produce and confirm the resulting documentation, after which
it is deleted. Audio is treated as PHI; it is never used for advertising
and never sold.
How We Store and Protect
Information
- All clinical data is stored in a HIPAA-compliant environment on
Google Cloud Platform. - Data at rest is encrypted using AES-256. Data in transit is
encrypted using TLS 1.2 or higher. - All API traffic between Round Smarter and PointClickCare requires
mutual TLS authentication using a client certificate. - Access is restricted to authenticated providers, scoped to the
facilities they are assigned to. - We maintain audit logs of read access to PHI.
- Round Smarter operates under Business Associate Agreements with the
Covered Entities it serves and with its own subprocessors where
applicable.
Retention
Clinical data retrieved from PointClickCare is held under a 90-day
rolling retention window per (patient, data type). A record’s
last_confirmed_at timestamp is refreshed each time
PointClickCare re-emits the same record through a polling cycle or
webhook event. Records not refreshed within 90 days are deleted by a
daily sweep job. AI-derived clinical summaries follow the same 90-day
window.
When a patient is discharged or a facility off-boards from Round
Smarter, retained data for the affected scope is purged ahead of the
normal sweep.
How We Use Information
We use the information described above strictly to operate the Round
Smarter platform on behalf of the Covered Entities we serve — generating
clinical briefs and AI-assisted documentation, retrieving the clinical
data those tasks require, and providing the authenticated user interface
that displays them. We do not sell PHI. We do not use PHI for
advertising. Aggregate, fully de-identified statistics derived from
platform operation may be used for system improvement and quality
monitoring; nothing released externally identifies any individual.
Artificial Intelligence
and Your Data
Round Smarter uses artificial intelligence to generate clinical
documentation. Three commitments govern how your data relates to the
models behind it.
We do not train models on protected health
information. Round Smarter does not use PHI to train, retrain,
or fine-tune any artificial-intelligence or machine-learning model. This
applies to clinical data retrieved from an EHR, audio recordings,
transcripts, and generated documentation alike.
Our AI subprocessors do not train on your data.
Round Smarter uses third-party language-model and speech-recognition
services to generate documentation. Those services are contracted so
that content Round Smarter sends them is used only to return a result to
us — it is not used to train or improve those vendors’ models, and it is
not retained beyond what is needed to process the request.
We do develop our products and AI systems using de-identified
data. Round Smarter creates de-identified data in accordance
with the HIPAA de-identification standard at 45 C.F.R. §
164.514(b), and uses that de-identified data to operate,
analyze, improve, and develop its products, services, and AI systems,
and for quality monitoring. Data de-identified to that standard is no
longer protected health information under HIPAA — it does not identify,
and cannot reasonably be used to identify, any individual, provider, or
facility. We create and use de-identified data only as permitted by the
Business Associate Agreement with the relevant Covered Entity, and we
never externally release anything that identifies any individual.
Sharing
We do not share PHI outside of:
- The Covered Entity that contracted with us
- PointClickCare, when writing back a provider-signed progress note to
the patient’s chart in PointClickCare at the provider’s explicit
instruction - The subprocessors named below, each engaged under a Business
Associate Agreement to deliver the platform - Disclosures required by law or by the BAA between Round Smarter and
the Covered Entity
Subprocessors
The following third parties may process PHI on Round Smarter’s
behalf. All PHI is processed within the United States.
| Subprocessor | Purpose | Location |
|---|---|---|
| Google Cloud Platform | Application hosting, database, and file storage | United States |
| Google Cloud Vertex AI | Hosted large-language-model inference for clinical briefs, SOAP notes, and order extraction |
United States |
| Deepgram | Medical speech-to-text transcription of provider dictation | United States |
We maintain this list current. Before adding a new subprocessor that
will process PHI, we will notify the Covered Entities we serve so they
may review the change under the governing BAA.
Provider Rights and
Account Information
Authorized providers using Round Smarter may request a copy of their
account information, request correction of inaccurate account
information, or close their account by emailing admin@roundsmarter.com.
Requests related to PHI are handled through the Covered Entity, per the
governing BAA.
Security Incidents
In the event of a security incident affecting PHI, Round Smarter will
notify the affected Covered Entity in accordance with the terms of the
governing BAA and applicable law.
Website Visitors
This section covers roundsmarter.com, our public
marketing website. It does not cover the Round Smarter platform, which
is described above.
- We set no analytics, advertising, or tracking
cookies on roundsmarter.com. There is no Google Analytics, no
advertising pixel, and no cross-site tracking. - Fonts are loaded from Google Fonts, and
demonstration video is embedded from YouTube in
privacy-enhanced mode (youtube-nocookie.com). Loading these
assets discloses your IP address and browser information to Google,
which acts as an independent controller of that information under its
own privacy policy. No cookie is set unless you play the video. - Booking a demonstration sends you to a Google
Calendar appointment page. The name, email address, and any note you
provide there are used solely to schedule and hold that meeting. - Email you send us is used solely to respond to you
and is retained in our business email system. - Our web host records standard server logs, including IP addresses,
for security and troubleshooting.
We do not sell or share personal information about website visitors,
and we do not use it for cross-context behavioral advertising.
Your Privacy Rights
Residents of California and of other US states with comprehensive
privacy laws have rights over personal information about them, including
the right to know what we collect, to obtain a copy, to correct it, to
delete it, and not to be discriminated against for exercising those
rights.
We do not sell personal information and we do not share it
for cross-context behavioral advertising, as those terms are
defined in the California Consumer Privacy Act. We have not done so in
the preceding twelve months.
To exercise a right, email admin@roundsmarter.com with the
subject line “Privacy.” We will verify your request by replying to the
email address on file. You may use an authorized agent.
Two important limits:
- PHI is out of scope. Protected health information
that Round Smarter processes as a Business Associate is exempt from
these state laws and is governed by HIPAA and the Business Associate
Agreement with your healthcare provider. Direct those requests to your
provider, who will route them to us. - Provider account information is handled as
described under “Provider Rights and Account Information” above.
Children
Round Smarter is a professional tool intended solely for licensed
healthcare providers and authorized facility staff. It is not directed
to, or intended for use by, children, and we do not knowingly collect
personal information directly from anyone under the age of 18. Any
information about minors that appears in the platform is patient
clinical data processed on behalf of a Covered Entity under a BAA — not
information collected from a child user.
Contact
For privacy questions or to report a privacy concern, contact:
Email: admin@roundsmarter.com (subject
line: “Privacy”)
Updates to This Statement
We may update this statement as our practices evolve. Material
changes will be reflected in the effective date at the top of this page
and communicated to the Covered Entities we serve through the BAA
process.
Round Smarter — RoundSmarter LLC Effective: July 31,
2026