Privacy and Security

HealthKey builds and operates patient health record platforms for patient foundations, advocacy organisations and other partners. This page explains how we protect the health information we process on their behalf, and what we will and will not do with it.

1. Our role

HealthKey, Inc. (“HealthKey”, “we”, “us”) provides technology to organisations that run services for patients, such as a patient foundation’s registry or member portal. In those services:

• The organisation is the data controller. It decides what information is collected, why, and how it is used and shared. Its own privacy policy and consent choices tell you what it does with your information.
• HealthKey is the data processor (in the US, a “service provider”). We build, host, maintain and secure the platform, and we process your information only on the organisation’s documented instructions, under a written data processing agreement.

If you have questions about how your information is used, or want to change your permissions, please contact the organisation whose service you joined. Its contact details are in its privacy policy.

This page covers the platforms HealthKey operates for other organisations. CancerBot, a service HealthKey owns and runs directly, has its own privacy policy.

2. What we will never do

Our data processing agreements with every organisation we work with prohibit us from using member information for our own purposes. In particular, we will not:

• sell or rent your information, or share it with anyone the organisation has not authorised
• use it for advertising or marketing, or to build profiles for anyone other than the organisation
• use it to develop, improve or train our own products or services, including AI models
• combine it with information from other organisations we work with
• look at individual records except where needed to support or secure the service, as described below.

We may use information about how the platform itself is running, such as system performance and error rates, to operate and improve it. That information contains no personal data.

3. AI and your information

Your information is never used to train AI models, by us or by anyone we work with.

Some services an organisation chooses to enable may use AI to process information on its behalf, for example to read an uploaded document and turn it into structured entries in your record. Where that happens:

• the AI processes your information only to perform that task for the organisation
• any AI provider we use is bound by contract not to retain your information or use it for training, and is listed as one of our service providers
• results are written into your record, where they can be seen, checked and corrected, rather than used out of sight.

4. Where information is stored

We host each organisation’s service on Google Cloud, in the region agreed with that organisation. For example, services for UK-based organisations are hosted in the United Kingdom. Information is not moved to another hosting region without the organisation’s agreement. Service emails are sent through SendGrid from its European Union or United States region, again as agreed with each organisation.

5. International access and transfers

HealthKey’s team is based in the United States and the United Kingdom. Members of our team may access a service from outside the hosting region to support and maintain it. That access is limited to what the task requires, and it is logged.

Where information about people in the UK, EU or Switzerland is accessed from a country without an adequacy decision, we rely on appropriate safeguards: the European Commission’s standard contractual clauses with the UK Addendum. The organisation you joined can give you a copy of the relevant safeguards on request.

6. How we protect information

Encryption

• Information is encrypted in transit using TLS.
• Information is encrypted at rest, including databases, file storage and backups.

Access control

• Access is granted by role and limited to what each person needs. For example, a person who sends emails for an organisation can see contact details but not health records.
• Names and contact details are stored separately from health information.
• HealthKey staff access production systems only to support, maintain or secure the service. Access is personal and is removed when no longer needed.

Audit

• Every access to, change to or export of a member record is written to an audit log.
• The log is tamper-evident: each entry is cryptographically chained to the one before it, so any alteration can be detected. Entries cannot be deleted.

Accounts

• Sign-in is protected by account lockout after repeated failed attempts, prevention of password reuse, and forced password changes where an account may be at risk.

Logs and IP addresses

• IP addresses are kept only in security logs, which are retained for 90 days and used to detect and investigate misuse.

Testing and review

• We test and review our security measures regularly, keep software dependencies up to date, and review changes to the platform before they are released.
• If you believe you have found a security vulnerability, please tell us at support@healthkey.ai. We will acknowledge your report and keep you informed.

7. Deletion and backups

• When an account is closed, or the organisation asks us to delete a record, it is deleted from the live database straight away.
• We keep backups only so that we can restore the service if something goes wrong. Backups are kept for no more than 30 days, so deleted information leaves our backups within 30 days.
• If we ever have to restore a backup, we first re-apply every deletion made since that backup was taken, so deleted records are not brought back.
• A record that a deletion took place, and when, is kept in the audit log, but the deleted information is not.
• The organisation decides how long other information is kept, such as records of the permissions you gave. Its privacy policy explains these periods.

When a service ends

• If an organisation stops using our platform, we return its information to it, delete it, or both, as it instructs, within 30 days.
• Backups follow the same schedule, so copies in our backups are also gone within 30 days.
• We keep information after that only where the law requires us to, and only for as long as it requires.
• Members can download a copy of their record at any time, as a readable PDF and as a standard FHIR file that can be moved to another service.

8. Security incidents

If we become aware of a security incident affecting information we process for an organisation, we will tell that organisation without undue delay, and within 48 hours. We will give it the information it needs to meet its own obligations, including notifying regulators and affected people where the law requires, and we will work with it to contain the incident and prevent it from happening again.

9. Our service providers

We use a small number of service providers (sub-processors) to run the platform. Each is bound by contract to protect information and use it only to provide its service to us. We tell the organisations we work with before we add or replace a service provider, so that they can object.

10. US privacy laws and HIPAA

We protect information about people in the United States to the same standard as everyone else.

HIPAA applies to healthcare providers, health plans and the businesses that work for them. Many of the organisations we work with, such as patient foundations collecting information directly from their members, are not covered by HIPAA. Where an organisation is covered, HealthKey signs a business associate agreement with it and meets HIPAA’s requirements for that service. Our hosting provider, Google Cloud, is signing a business associate agreement with us.

US state laws protect consumer health information whether or not HIPAA applies, for example Washington’s My Health My Data Act. We support the organisations we work with in meeting these laws: we process health information only as they instruct, we do not sell it, and we notify them of security incidents so that they can meet their notification duties, including under the Federal Trade Commission’s Health Breach Notification Rule where it applies.

11. Standards and open source

• HL7 Personal Health Record standard. Our platform meets all 25 essential functions of an oncology functional profile of the HL7 Personal Health Record System Functional Model, Release 2, including tamper-evident audit, authentication controls, consent-driven handling of information and versioned terminology management. The profile, its criterion-level traceability matrix and the automated tests that check it are published in our public repository.
• Open source. The core of our platform is open source under the Apache 2.0 licence at github.com/healthkey-ai, so anyone can inspect how it stores, derives and protects information.
• Open standards. Records are stored using the OMOP Common Data Model and can be exported in HL7 FHIR format, so your information is never locked into our platform.

12. Your rights and requests

Depending on where you live, you may have rights to access, correct, download or delete your information, to withdraw permissions, and to complain to a data protection authority. Because the organisation you joined controls your information, please send requests to it. Many can be handled directly in your account settings.

If you contact us about a service we run for an organisation, we will pass your request to that organisation promptly and help it respond.

13. Information HealthKey controls

We are the data controller for a small amount of information about our own business contacts, such as people who email us, request a demonstration or work with us at partner organisations, and visitors to healthkey.ai. We use it only to respond to you, manage our relationships and run our website. We do not sell it. healthkey.ai uses analytics cookies only if you accept them. You can ask us to access, correct or delete this information at any time using the contact details below.

14. Contact us

We may update this page as our platform and the law change. The date at the top shows when it was last updated. We tell the organisations we work with in advance about changes that affect how we process their members’ information.