Privacy Policy

Introduction

Glace, operated by Glace Technologies Inc. ("we", "us", "our"), values your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, protect, and disclose information gathered from users ("you", "user") of our website https://glace.sh and all its subdomains, including demo.glace.sh and app.glace.sh.

Information We Collect

We may collect the following types of information:

• Personal Information: Information that identifies you personally, such as your name, email address, account credentials, gender, age, and contact details provided during account registration or customer support interactions.
• Usage Information: Non-personal information regarding your interaction with our platform, such as access dates, session durations, device type, browser type, IP address, operating system, and pages visited.
• Content Information: Brand assets, media, patient-facing content, and other materials you upload, provide, or approve on the platform, along with the campaign, scheduling, and attribution data generated as the platform operates.
• Patient and Appointment Information: Where you use features such as our AI voice agents, AI receptionists, or scheduling and attribution integrations, the platform may receive and process information about your patients, including names, contact details, appointment and booking details, call recordings or transcripts, and, in some cases, protected health information. We process this information on your behalf as a business associate under HIPAA, as described under "Information Sharing and Disclosure" below.

Use of Information

We use collected information to:

• Provide, maintain, and enhance our services
• Process transactions and manage user accounts
• Respond to user inquiries and provide customer support
• Monitor usage trends and analyze platform performance
• Develop new products, services, and features
• Communicate with you about updates, security alerts, and promotional offers

Data Retention

We only retain the information we collect for as long as is necessary to provide our services or for our legitimate interests, such as accounting and legal compliance. At the end of that period, the collected information is either deleted or de-identified.

Data Protection and Security

We implement commercially reasonable, industry-standard security measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Information Sharing and Disclosure

We do not sell or rent your personal information to third parties. We may share your information under these conditions:

• With trusted service providers who assist us in operating, hosting, analyzing, or optimizing our platform, under strict confidentiality agreements and, where they handle protected health information, a Business Associate Agreement
• In response to legal obligations or valid requests from authorities
• To protect our rights, property, safety, or the integrity of our services
• We may share anonymized, aggregated, or de-identified usage insights publicly or with third parties for research, analytics, or promotional purposes; such insights never include protected health information

HIPAA and protected health information. Many of our clients are healthcare practices. When Glace creates, receives, maintains, or transmits protected health information ("PHI") on a practice's behalf, Glace generally acts as a "business associate" and the practice as a "covered entity" (or an upstream business associate) under the U.S. Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA"). In those cases, the applicable Business Associate Agreement ("BAA") governs our handling of PHI and controls over anything to the contrary in this Privacy Policy. In general:

• We enter into a BAA with the practice before receiving or processing PHI, and we use and disclose PHI only as permitted by that BAA and by HIPAA, such as to provide the services requested by the practice, as directed by the practice, or as required by law. We do not sell PHI, and we do not use or disclose PHI for our own advertising or marketing.
• We limit access to PHI to workforce members who need it to provide the services and apply the minimum-necessary standard.
• We maintain commercially reasonable administrative, physical, and technical safeguards designed to protect PHI, consistent with our obligations under the applicable BAA and HIPAA.
• Where subcontractors create, receive, maintain, or transmit PHI on our behalf, we require them to agree in writing to protections consistent with those in our BAA.
• If we become aware of a breach of unsecured PHI, we will notify the affected practice in accordance with the applicable BAA and the HIPAA Breach Notification Rule.

If you are a patient of a practice that uses Glace, your health information is controlled by that practice as the covered entity. Please direct any requests regarding your PHI, such as access or amendment, to your practice, which will coordinate with us under our BAA.

Your Rights and Consent

By using our platform, you consent to our collection and use of your data as described in this Privacy Policy. You have the right to:

• Know and access the personal data we hold about you
• Request correction or update of your personal data
• Request deletion of your personal data, subject to legal or contractual obligations
• Withdraw consent or object to certain types of data processing
• Right to appeal a failure to act on the part of Glace within the time set forth in the applicable consumer data privacy law

To exercise these rights, contact us at contact@glace.sh.

Requests Made Through Agents

You may have the option to designate, through the use of a proper legal instrument, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf.

Discrimination Based on the Exercise of Rights

While Glace would never discriminate against anyone who chooses to exercise their statutory rights, it is important to note that our provision of services to you may be completely related to our ability to collect data. Therefore, if you have asked us to stop collecting data about you, then we may be unable to provide you with services.

Policy Updates

We may update this Privacy Policy periodically to reflect changes in our data practices or applicable laws. All revisions will be posted prominently on our website, along with the effective date. Your continued use of our platform after changes signifies your acceptance of the updated Privacy Policy.

Contact Us

If you have any questions, concerns, or feedback regarding our privacy practices, please reach out to us at contact@glace.sh.