Patient consent, privacy, and HIPAA
This section applies to practices that license PreviewMD and embed the widget on their own website.
Your role and ours
You own the relationship with every visitor who uses the widget on your website. For each image and each piece of information a visitor submits through the widget on your site, you are the controller of that data and we act as your technology vendor. We process what the widget sends us solely to generate the requested visualization and to deliver the resulting lead to you.
You obtain consent
Before you deploy the widget, you must obtain each visitor’s consent to upload a photograph of themselves and to have that photograph processed by a third-party AI model in order to produce a simulated result. You are responsible for the wording of that consent, when you collect it, and your record that you collected it. You are responsible for publishing your own privacy policy covering this collection, and for confirming that anyone who submits a photograph is old enough to consent under the law of their state.
We are not your business associate
The Service is built so that it never receives protected health information. We do not retain visitor photographs, we do not receive medical records, and we do not create, maintain, or transmit PHI on your behalf. We are not your HIPAA business associate, and this agreement is not a business associate agreement. You must not use the Service to transmit PHI, medical records, or any information drawn from a patient chart. Doing so breaches these Terms, and you are responsible for any disclosure that results.
Advertising and professional rules
You are responsible for complying with the advertising rules of your state medical board and any other body that regulates your practice, including any rule that governs simulated or before-and-after imagery. Once we deliver a visualization or a lead to you, how you present it, store it, and use it is yours to answer for.
Indemnity
You will indemnify and hold us harmless from any claim, demand, penalty, or expense (including reasonable attorneys’ fees) arising from your failure to obtain the consent described above, your use of the Service to transmit PHI, or your breach of a law or professional rule that applies to your practice.