Privacy Policy

Caridian is a revenue intelligence platform for medical practices, operated by Arxcore Group (“we”, “us”). This policy explains what information we collect when you use Caridian, how we use it and the choices you have.

Information we collect

• Account information: your name, work email and, if you sign in with Google, the basic profile Google shares with us (name, email address and profile picture).
• Access requests: the practice name, role, phone number and message you send when you ask for access.
• Practice data: clinical documentation, coding, claims and engagement data that an authorized practice uploads or connects. This can include protected health information (PHI), which we process only on behalf of the practice and under a business associate agreement where HIPAA applies.
• Usage data: technical logs such as sign-in times, IP address and browser type, used to keep the service secure and working.

How we use information

• To create and secure your account and decide whether to grant access.
• To provide the service to your practice, including AI-assisted code suggestions.
• To contact you about your access request, your account or the service.
• To monitor, troubleshoot and improve Caridian.

We do not sell personal information and we do not use PHI for advertising.

Google user data

When you choose “Continue with Google”, we receive only your name, email address and profile picture, and use them solely to sign you in and identify your account. We do not request access to your Gmail, Drive, Calendar or contacts. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Service providers

We rely on vetted providers to run Caridian: Supabase (database and authentication), Vercel (hosting), Anthropic (AI processing of clinical notes, without using them to train models) and Google (sign-in). They process data only to provide their services to us.

Security and retention

Data is encrypted in transit and at rest; sensitive clinical fields are additionally encrypted at the application layer, and access is limited to members of the practice that owns the data. We keep information for as long as the practice’s account is active or as required by law, and delete or return practice data when a customer agreement ends.

Your choices

You can ask us to access, correct or delete your personal information, or withdraw an access request, by writing to arxcore.admin@gmail.com. Requests about PHI should go to the practice that provided it.

Changes

We may update this policy. We will change the date above and, for significant changes, let account holders know.