1. Scope & applicability
This Privacy Policy describes how Sonnata AI, Inc. ("Sonnata", "we", "us") handles information when you visit our marketing website, request a demo, or when a hospital customer uses the Sonnata platform to engage with their patients on our behalf.
Different rules apply depending on your relationship with us:
- Website visitors and prospects — covered by this policy in full.
- Hospital customers — covered by this policy and by the Master Services Agreement (MSA) and Business Associate Agreement (BAA) you sign with us.
- Patients — your information is governed by your hospital's notice of privacy practices. Sonnata processes that information as a Business Associate of the hospital.
2. Information we collect
Information you provide
When you fill out a demo request, contact form, or correspond with us, we collect the name, work email, phone number, role, hospital or company, and the contents of your message.
Information collected automatically
When you visit our website, we collect basic technical information: IP address (typically truncated), browser type and version, referring URL, pages viewed, and timestamps. We use this to operate, secure, and improve the site.
Information processed on behalf of customers
When a hospital customer uses Sonnata, the platform processes records the customer sends us — account numbers, balances, contact information, and (where covered by a BAA) limited PHI such as service dates and codes. We process this information only to provide the Sonnata service to that customer.
3. How we use information
We use information to:
- Operate, maintain, and improve the Sonnata platform and website.
- Respond to demo requests, inquiries, and support tickets.
- Send transactional communications (e.g., account, security, and service notices).
- Send marketing communications to business contacts who opted in — you can unsubscribe at any time.
- Detect, investigate, and prevent fraud, abuse, and security incidents.
- Comply with our legal and contractual obligations.
We do not sell personal information. We do not use customer data to train generative or foundation models for use outside that customer's tenant.
4. PHI & HIPAA
When Sonnata processes protected health information (PHI), we act as a HIPAA Business Associate of the hospital customer. Our obligations are governed by the BAA we execute with each customer, which incorporates the requirements of 45 CFR §§ 164.502, 164.504, and 164.308–164.318.
Operational commitments include:
- Use and disclose PHI only as permitted by the BAA, applicable law, and the minimum-necessary standard.
- Maintain administrative, physical, and technical safeguards consistent with the HIPAA Security Rule.
- Notify customers of any breach of unsecured PHI without unreasonable delay, and in no event later than the timeframes required by the BAA.
- Return or destroy PHI at the end of the engagement, where feasible.
5. How we share information
We share information only as needed to operate the service, and only with:
- Subprocessors — vetted infrastructure, communications, and security providers, all bound by written agreements requiring confidentiality, security, and (where applicable) HIPAA-compliant terms. A current list is available on request.
- Your hospital or its authorized personnel — for patient information, we share with the hospital that engaged us.
- Legal and safety requests — when required by law or to protect rights, property, or safety, and only to the extent legally required.
- In a business transfer — in connection with a merger, acquisition, or asset sale, subject to contractual protections.
6. Security
We maintain a written information security program aligned to SOC 2 and HITRUST control families. Highlights include encryption in transit and at rest, tenant isolation, least-privilege access, MFA on all administrative interfaces, continuous logging and monitoring, regular vulnerability scanning, and annual third-party penetration testing. For details, see our Security & compliance page.
7. Data retention
We retain marketing and website information for as long as needed for the purposes described above, and we retain customer data and PHI for the duration of the customer engagement and any period required by the BAA, contract, or applicable law. After that, we delete or de-identify the information using methods consistent with industry standards.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, or port your personal information; to opt out of certain processing; or to lodge a complaint with a supervisory authority. To exercise these rights, contact us at privacy@sonnata.ai. We verify requests before acting and respond within the timeframes required by applicable law.
For patients: requests about your hospital records should be directed to your hospital, which controls that information.
9. Cookies & tracking
Our marketing website uses a small set of cookies for site functionality, analytics, and (where you opt in) marketing attribution. We do not use cookies inside the authenticated Sonnata platform for advertising. You can control cookies through your browser or, where available, through our cookie banner.
10. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you through the service or by email. Continued use of the site or services after an update means you have read and understood the updated policy.
11. Contact us
Questions about this policy or our privacy practices?
- Privacy team: privacy@sonnata.ai
- Security: security@sonnata.ai
- General: contact form