Safar Privacy Policy

• Protected health information generated through client use of the platform is handled in accordance with HIPAA and applicable privacy and security law.
• Safar acts with the permission of the practitioner and handles client information under a Business Associate Agreement.
• Safar does not access, use, or disclose client information beyond what is necessary to deliver the service.

Client information is used only to provide the service and support the care relationship between the practitioner and client. It is not used for other purposes without authorization.

• Safar does not sell protected health information.
• Safar does not use protected health information for marketing without explicit authorization.
• Minimum necessary standard: internal systems and personnel access only the information required to perform a specific function.
• Any provider, vendor, or subcontractor that handles protected health information on Safar’s behalf is bound by a Business Associate Agreement requiring equivalent protection.

Safar uses automated and AI-assisted systems to support practitioner workflows. The following describes how client information is handled within those systems.

Any automated or AI-assisted processing of client information occurs only within systems bound by appropriate agreements. Protected health information is not shared with any third-party AI system unless a Business Associate Agreement with that provider is in place.

Before information is processed by automated systems, Safar separates and protects identifying information. Protected health information is maintained within Safar's encrypted environment.

AI-generated signals, reflections, and protocol outputs are provided to practitioners as informational inputs. They do not constitute clinical advice, diagnosis, or treatment, and are subject to practitioner review and judgment.

Safar maintains administrative, physical, and technical safeguards designed to protect client information. The detailed controls are documented in Safar's internal security policies.

Information within Safar's environment is protected such that individual clients and practitioners cannot be identified from Safar's processed or encrypted data.

Safar does not disclose identifying information about the work conducted by practitioners on the platform, except as required by law or with authorization.

Consistent with the rights HIPAA provides to individuals, clients may exercise the following with respect to their protected health information. Practitioners should be aware of these rights as part of their obligations to the clients they serve.

• Right of access: clients may request to see and receive a copy of their information.
• Right to amend: clients may request correction of information they believe is inaccurate or incomplete.
• Right to an accounting of disclosures: clients may request a list of certain disclosures of their information.
• Right to request restrictions: clients may request limits on how their information is used or disclosed.
• Right to confidential communications: clients may request that Safar communicate with them by alternative means or at an alternative location.
• Right to be informed: clients may request information about how their data is protected and used.
• Right to raise a concern: clients may raise a privacy concern or complaint without fear of retaliation.

Rights requests may be directed to legal@joinsafar.com.

In the event of a breach affecting protected health information, Safar will provide notification as required by law and by its agreements with practitioners.

Protected health information is retained only as long as necessary for the purposes described here, for the duration of the care relationship, or as required by law and clinical record-keeping obligations. Practitioners may contact Safar at legal@joinsafar.com with questions about retention practices specific to their account.