Privacy Policy

1. Who We Are

UM-AI is an AI-powered utilization-management platform operated by SSP DEVELOPMENT LLC (d/b/a UM-AI), a U.S. company. This policy describes how we handle information collected through umgpt.ai and the UM-AI service.

2. Information We Collect

• Account information — name, work email, organization, role.
• Usage information — evaluation metadata (specialty, decision, timestamps), authentication and audit events.
• Clinical input — text submitted by clinicians to obtain an evaluation.
• Billing information — handled by our payment processor; we do not store card data.

3. How We Use Information

We use information to provide the service, generate evaluations, secure the platform, meet legal obligations, and bill subscribers. We do not sell personal information and we do not use customer traffic to train third-party AI models.

4. Protected Health Information (PHI)

When clinical input contains PHI, we act as a HIPAA Business Associate of the covered entity that submits it, under an executed Business Associate Agreement (BAA). PHI is processed transiently to produce the evaluation result and is not retained as a clinical record by UM-AI. Operational audit logs required by 45 CFR §164.316 are retained for the period required by HIPAA.

5. EHR Integration (Vim Marketplace)

When UM-AI is launched inside an EHR via the Vim Canvas SDK, the host EHR (not the end user) is responsible for the lawful disclosure of PHI to UM-AI under the covered entity's BAA. End users do not need to take any individual action to enable this flow.

PHI Handling for EHR-Integrated Users

If you access UM-AI through an Electronic Health Record (EHR) integration (such as the Vim Canvas widget), your use of the platform and acceptance of this Privacy Policy constitutes your authorization for UM-AI to process Protected Health Information (PHI) — including clinical notes, diagnoses, referral data, and imaging orders — on your behalf for the purpose of AI-assisted utilization management. This consent is captured and logged at the time of account activation in compliance with HIPAA 45 CFR §164 and our SOC 2 Type 2 security controls. You may withdraw this authorization at any time by contacting privacy@umgpt.ai.

6. Your Rights

You may request access, correction, deletion, or portability of personal information we hold about you by emailing privacy@umgpt.ai. Where we process PHI on behalf of a covered entity, individual rights requests should be directed to that covered entity, who will coordinate with us under the BAA.

Right to lodge a complaint. If you believe your privacy rights have not been respected, you have the right to lodge a complaint with the relevant supervisory authority. In the United States, you may contact the Federal Trade Commission (FTC) or, for HIPAA matters, the HHS Office for Civil Rights (OCR). EU/EEA residents may contact their local Data Protection Authority (DPA). We encourage you to contact us first at privacy@umgpt.ai so we can attempt to resolve your concern directly.