Privacy Policy

1.Who we are and what this policy covers

Pretaa, Inc., doing business as Huml Health (“Huml,” “we,” “us”), wrote this policy. It explains what information we collect, how we use it, and what choices you have.

This policy covers three things:

Our website, huml.health.
The Huml platform that treatment facilities and their staff use.
The Huml mobile app and the wearable devices connected to it.

Huml builds software for behavioral health and substance use treatment providers. Our software surfaces signals from wearable and voice data for clinicians to review. It does not diagnose, treat, or make care decisions.

If you are a patient. Your treatment facility is our customer. We handle your health information on its behalf under a Business Associate Agreement. Your facility’s Notice of Privacy Practices governs your rights as a patient. Section 5 explains more.

2.Information we collect

We collect health, biometric, and voice data about patients, plus account and contact data about staff and website visitors.

Category	What it includes	Where it comes from
Wearable and biometric data	Heart rate, heart rate variability, blood oxygen, skin temperature, sleep, steps and movement, activity, wear time, device status	The wearable device and the Huml app
Voice data	Voice recordings, analyzed for acoustic markers. We do not transcribe them. We delete the raw recording after analysis and keep only the voice markers.	The Huml app
Assessments and surveys	Answers to check-ins, assessments, and forms your facility assigns	You, through the Huml app or your care team
Clinical context	Name, date of birth, program, level of care, admission and discharge dates	Your treatment facility and its health record system
Location data	Zone entry events and last known location from the app. Room-level location inside facilities that use the indoor location add-on.	The Huml app and the wearable device
Signals we derive	Personal baselines for sleep and waking hours, flags when a reading departs from your baseline, written summaries for your care team, level-of-care documentation support, and flags that a patient may be at risk of leaving treatment early	Huml’s software, from the data above
Staff account data	Name, work email, role, login activity, sign-in security settings	The facility and the staff member
Website and inquiry data	Name, email, organization, and message when you contact us or request a demo	You
Technical data	IP address, browser type, pages visited, date and time of visit	Your browser, through cookies and server logs
Job applicant data	Contact details, resume, and application materials	You

Location and voice controls

The watch. The watch collects data only while you wear it. Taking it off stops collection.
Background location. The app can check location in the background to detect entry into a flagged zone. We store the zone event and your last known location. We do not keep a continuous location history. You can turn off location access in your phone’s settings at any time.
Indoor location. Room-level location works only inside facilities that use the add-on. It runs through the watch.
Voice recordings. Voice features run only where your facility uses them. We delete each raw recording after analysis and keep only the voice markers.
Transcripts. We do not create transcripts of what you say.

Our website uses cookies to run the site and to understand how visitors use it. We use Google Analytics for this. You can block cookies in your browser. Some site features may stop working if you do.

3.How we use information

We use information to run the service for treatment facilities and to operate our business.

Provide the service. We analyze wearable and voice data and surface signals, summaries, and alerts for the care team to review.
Support the facility’s work. We help facilities document care and track outcomes over time.
Keep the service secure. We monitor, troubleshoot, and protect our systems.
Respond to you. We answer inquiries, demo requests, and support requests.
Send business updates. We email business contacts who ask to hear from us. Every email includes an unsubscribe link.
Meet legal duties. We comply with law, contracts, and valid legal process.

What we do not do

We do not sell patient health information or any information that identifies you.
We do not use patient data for advertising or marketing.
We do not train or improve our models on identifiable patient data.
We do not share identifiable patient data with outside parties for their own use.

Our software does not make decisions about anyone’s care. A clinician reviews every signal and makes the call.

4.How we share information

We share information only with the parties below, and only for the reasons listed.

Your treatment facility. Your care team sees your data in the Huml platform.
Service providers. Vendors help us run the service under written contracts. Any vendor that touches patient health information signs a Business Associate Agreement with us.
Legal requests. We disclose information when law requires it. Substance use treatment records get added protection, described in Section 5.
Business changes. If Huml merges or is acquired, information may transfer to the new owner. This policy continues to apply.
With your consent. We share information with others when you direct us to.

Two vendors handle patient health information. Amazon Web Services hosts the service, and Canary Speech analyzes voice data. Both have signed Business Associate Agreements with us. Our vendors for alerts and device management receive no identifiable patient data. Where a facility asks, we also connect to its health record system.

We never sell patient health information. We never share identifiable patient data with outside parties for their own use.

5.HIPAA and 42 CFR Part 2

Huml is a business associate of the treatment facilities we serve. We are not your healthcare provider.

We use and disclose patient health information only as HIPAA and our agreement with each facility allow. Where this policy and that agreement differ, the agreement controls for patient health information.

Substance use disorder treatment records carry extra federal protection under 42 CFR Part 2. We follow those rules when we handle these records for a facility. We do not disclose them for use in legal proceedings against a patient without the consent or court order the law requires.

Your facility’s Notice of Privacy Practices explains how to see your records, correct them, or file a complaint.

After discharge. Patients get the Huml app through their treatment facility, including after discharge. Monitoring after discharge runs only with your consent.
If you withdraw. Collection stops. Data already collected stays in your facility’s record until the facility’s agreement with us ends.
If your facility’s contract ends. Monitoring stops for that facility’s patients, including those already discharged. We return or delete patient data as that agreement requires.
Consent for substance use records. Your facility collects the consent that 42 CFR Part 2 requires before it shares those records with us. We honor any limit or revocation the facility passes on.
State health privacy laws. Some states have added laws for consumer health data. Patient data we handle for facilities is governed by HIPAA and Part 2. We follow state law for any health data that falls outside them.

6.De-identified and aggregate data

We de-identify patient data only where our agreement with a facility allows it. We follow the HIPAA standard at 45 CFR 164.514.

Removing names or combining records does not make data de-identified. Data qualifies only after it meets one of HIPAA’s two methods. One is a written determination by a qualified expert. The other is removal of all 18 identifier types HIPAA lists, which include voice prints and other biometric identifiers.

We use de-identified data only as each agreement allows. Uses can include improving the service, research, and studying treatment outcomes across facilities.

We license or sell de-identified data only where the facility’s agreement permits it and the law allows it. We never try to re-identify de-identified data. Anyone who receives it must agree in writing to the same rule.

7.Retention and security

We keep patient data for the term of our agreement with your facility. When that agreement ends, we return or delete the data as it requires, unless law requires longer.

Raw voice recordings. Deleted after analysis.
Wearable, clinical, and derived data. Kept for the term of the facility’s agreement. This includes scores, flags, and summaries.
Backups. Encrypted. Deleted data leaves our backups on the regular backup cycle.
Vendor copies. Our vendors must return or delete patient data when their work for us ends.
De-identified datasets. These no longer identify anyone. We may keep them after an agreement ends where that agreement allows.

We keep website, inquiry, and applicant data only as long as we have a business need for it.

We protect information with these safeguards:

Encryption in transit and at rest.
Access limited by role to staff who need it.
A second sign-in step for facility staff, with single sign-on supported.
Written contracts with every vendor that handles personal information.

No system is perfectly secure. If a data incident affects patient data, we notify the affected facility without unreasonable delay and within the time its agreement sets.

Our Data Policy explains in more detail how we handle, protect, and delete data.

8.Your rights and choices

Patients. Your privacy rights run through your treatment facility. Ask your facility to see, correct, or get a copy of your records. We help the facility respond.

You can ask what Huml holds about you. You can withdraw from monitoring at any time, with no effect on the rest of your care. You can turn off location access in your phone’s settings.

Facility staff. Ask your facility administrator to update or remove your account.

Website visitors and business contacts. You can ask us to show, correct, or delete the personal information we hold about you. You can unsubscribe from our emails at any time.

Some states give residents added privacy rights. We honor valid requests under those laws, and we never treat you worse for making one. Email privacy@huml.health to make a request. We may ask for details to verify your identity.

9.Children, policy changes, and contact

Children. Our website and services are for adults. We do not knowingly collect information from anyone under 18. The facilities we serve treat adults only.

Changes. We review this policy every year. We post updates on this page and change the effective date. We tell facilities directly about material changes.

Contact. Pretaa, Inc. DBA Huml Health, 110 NW 2nd Street, Bentonville, Arkansas 72712. Email privacy@huml.health.