Privacy Policy

1. Who this policy covers

CyberNetX LLC ("CyberNetX," "we," "us") operates talaria, a messaging platform that healthcare practices and other businesses use to send appointment reminders, alerts and account notifications to their own patients and customers.

This policy explains two different relationships, and it matters which one applies to you.

If you are a practice or business using talaria, we process data on your behalf. You decide what is sent and to whom; we deliver it.

If you received a message sent through talaria, your relationship is with the practice that sent it, not with us. We delivered that message under their instruction. We do not build profiles of message recipients, and we do not contact recipients on our own behalf.

2. Protected health information and our role under HIPAA

Where a customer is a HIPAA covered entity, that customer is the Covered Entity and CyberNetX acts as a Business Associate. We execute a Business Associate Agreement before any protected health information (PHI) is processed.

We do not claim to be "HIPAA certified." No such federal certification exists. What we can state precisely: our infrastructure runs on Amazon Web Services under an executed AWS Business Associate Addendum, PHI is encrypted in transit and at rest using customer-managed keys, and tenant data is isolated at the infrastructure layer rather than only by application logic.

As a Business Associate we use and disclose PHI only as permitted by the applicable Business Associate Agreement, as required to provide the service, or as required by law.

3. What we collect

From practices using the platform: account and contact details for your staff, billing contact information, and the configuration you create — templates, schedules, and sending preferences.

On behalf of practices: the contact records and appointment data you import or send to us, and the message content you author. This may include PHI. We hold it to deliver your messages and to report on delivery.

Automatically: delivery events from our messaging providers (sent, delivered, bounced, failed, opened where available), inbound replies to your number, and security and audit logs recording who accessed what and when.

We do not collect message recipient data from any source other than the practice that sent the message. We do not buy contact lists, and we do not enrich contact records from third parties.

4. How we use it

To deliver the messages a practice instructs us to send, to report delivery outcomes back to that practice, to maintain the audit trail our customers' compliance obligations require, to secure and operate the service, to bill for usage, and to meet legal obligations.

We do not sell personal information or PHI. We do not share it for advertising. We do not use message content or PHI to train machine learning models.

5. Subprocessors

We use Amazon Web Services (AWS) for all infrastructure, including compute, storage, email delivery and SMS delivery. AWS acts as our subprocessor under an executed Business Associate Addendum, and all data is held in United States regions.

Mobile carriers necessarily receive the content and destination of SMS messages in order to deliver them. That is inherent to sending SMS and is not something any provider can avoid.

If we add a subprocessor that processes PHI, we will update this list before that subprocessor begins processing.

6. How long we keep it

Message content and delivery records are retained while a practice's account is active, so that the practice can report on what was sent.

When an account is terminated, PHI is deleted within 30 days. A practice may request an export before deletion, and we will provide it in a machine-readable format.

Audit logs are retained for six years, which is the retention period HIPAA requires for documentation of this kind. These logs record access and administrative actions; they are not message content.

Suppression and opt-out records are retained for as long as we operate the sending number or domain. Deleting a record of someone's opt-out would risk messaging a person who asked not to be messaged, which is precisely the harm the record exists to prevent.

7. Security

Data is encrypted in transit using TLS and at rest using AWS KMS customer-managed keys.

Tenant isolation is enforced below the application layer. Each request runs under short-lived credentials scoped to a single tenant's data by AWS IAM policy, so a defect in application code cannot read another tenant's records. Access to production systems is through short-lived federated sessions; we maintain no long-lived access keys.

Every access to tenant data is recorded in an append-only audit log.

No system is perfectly secure, and we do not claim otherwise. If a breach of unsecured PHI occurs, we will notify the affected Covered Entity without unreasonable delay and within 60 days of discovery, as the HIPAA Breach Notification Rule requires.

8. Your choices

If you received a message and want it to stop, reply STOP to any SMS. The opt-out is processed immediately and applies to that practice's messages. For email, use the unsubscribe link, or contact the practice directly.

Because the practice that sent the message controls the underlying record, requests to access, correct or delete your information should go to that practice. If you contact us instead, we will route your request to them and support them in responding.

Practices using the platform can export or delete their data at any time from within the product, or by contacting us.

9. Children

The platform is sold to businesses, not to consumers, and is not directed at children. A practice may send appointment reminders concerning a minor patient to that minor's parent or guardian; those records are held under the practice's instruction and their own legal obligations.

10. Changes and contact

We will post material changes to this policy on this page and update the effective date above. Where a Business Associate Agreement is in force, that agreement governs if it conflicts with this policy.

Questions about this policy, or about data we hold: support@cybernetx.co.