Mental Health Data Services, Inc. (“Company,” “we,” “our,” or “us”) operates the Compass platform and prepared this Privacy Notice (“Privacy Notice”) to explain how we collect, use, share, and otherwise process Personal Information in connection with the Platform, using practices that respect your privacy and comply with applicable law.
This Privacy Notice applies to Personal Information collected through the Compass online platform or mobile application operated by us (the “Platform”). It covers our data practices as of the date posted. It does not apply to information collected through other means, including separate business or marketing activities. “Personal Information” refers to information that identifies or can reasonably be linked, directly or indirectly, to a particular individual.
The Platform is intended solely for use by licensed healthcare professionals, including physicians, nurse practitioners, physician assistants, and other licensed clinical staff. It is not directed at patients or consumers.
Information We Collect
We collect Personal Information you voluntarily provide when using the Platform, including at registration and when requesting support. Personal Information may include:
- First and last name
- Postal address
- Email address
- Telephone or mobile number
- Professional license information
- Other information you provide when contacting us
Platform Administration. Once authenticated, licensed clinicians may use the Platform to enter and process patient treatment information, including sensitive health information such as clinical, mental health, and substance use disorder records. In those situations, the Platform processes Personal Information on behalf of healthcare providers and at their direction.
To the extent that Protected Health Information (“PHI”) is processed by Compass in its capacity as a HIPAA Business Associate, that information is governed by the applicable Business Associate Agreement and the Notice of Privacy Practices provided by the relevant Covered Entity, and not by this Privacy Notice. Where Compass processes PHI on behalf of an individual subscriber who is a Covered Entity or operates within one, the individual subscriber is responsible for ensuring an appropriate Business Associate Agreement is in place with Compass before submitting PHI to the Platform.
To the extent the Platform processes records relating to substance use disorder diagnosis, treatment, or referral for treatment that are governed by 42 CFR Part 2, those records are subject to the confidentiality requirements of Part 2 and are processed by Compass only in accordance with the applicable Business Associate Agreement and the consent and disclosure requirements of Part 2. Such records may not be re-disclosed without patient consent except as permitted by Part 2.
Where the Platform processes mental health, behavioral health, or other sensitive health information, the licensed healthcare provider using the Platform is responsible for obtaining any consents or authorizations required by applicable law prior to submitting such information to the Platform, including under applicable state comprehensive privacy laws. Compass applies appropriate technical and organizational safeguards to such information consistent with its role as a service provider or processor.
Even where no Personal Information is submitted, we may collect non-personal, non-identifiable information about Platform use for statistical purposes.
Information We Collect Through Technologies
We may collect certain information automatically through technology when you use the Platform.
Device Information
Depending on permissions granted and other factors, Compass may receive information about your device, including:
- Device attributes such as operating system, hardware version, device settings, battery and signal strength, and device identifiers
- Connection information such as mobile operator or ISP name, browser type, language, time zone, mobile phone number, and IP address (collected for security purposes)
Location Data
The Platform may access your device’s GPS or other location services to show nearby locations, directions, or other relevant information. You can disable location sharing in your device settings, but some Platform features may be limited as a result. We use location information solely to provide relevant services based on your location.
Cookies and Other Tracking Technologies
We use cookies solely to operate the Platform. Cookies are small files placed on your device used to compile aggregate data about site traffic and interaction. You may refuse cookies by adjusting your browser settings, but doing so may limit access to certain parts of the Platform.
Cookies on the Platform are limited to Strictly Necessary Cookies, which are required for Platform operation, including enabling login to secure areas. These are session cookies erased when you close your browser.
Your browser may allow you to control or block cookies. If you configure your device to block all cookies, certain Platform features may be disrupted.
Occasionally, the Platform may include links to third-party products or services. Those third parties may use their own tracking technologies. We do not control third-party tracking technologies, and we encourage you to review those parties’ separate privacy notices before sharing information with them.
Global Privacy Control
We process opt-out preference signals from Global Privacy Control (“GPC”). Compass does not sell Personal Information or share it for cross-context behavioral advertising. If you use GPC, the Platform will recognize your signal and treat it consistently with our data practices. For more information, visit https://globalprivacycontrol.org/.
Advertising
The Platform may display paid advertising, which may include advertising from pharmaceutical manufacturers and other healthcare-related companies. Ads are served at random and are not selected or targeted based on clinical information, medication queries, patient profile data, or any other Personal Information you enter into the Platform. Ad content is clearly labeled as advertising and does not constitute a clinical recommendation by Compass. Compass is responsible for ad delivery. No third-party ad network receives your Personal Information for ad targeting purposes, since ads are not targeted. If ads are served through a third-party ad network, that network may still receive standard technical data as part of normal ad delivery, such as IP address and device identifiers, even though no targeting occurs.
Compass does not use PHI governed by a Business Associate Agreement for ad targeting purposes except to the extent expressly permitted by the applicable Business Associate Agreement.
How We Use and Share the Information We Collect
We process and share Personal Information only to the extent reasonably necessary to fulfill your requests and meet our legitimate business and legal objectives. We do not sell your Personal Information. We do not share Personal Information with unaffiliated third parties solely for their own direct marketing purposes. We do not share Personal Information for cross-context behavioral advertising. When we disclose Personal Information to service providers, we require by contract that they access your data only to perform those services.
Business Activities
We generally process and may disclose Personal Information to:
- Perform transactions and services you initiate
- Register and authenticate your account
- Respond to questions about our services
- Verify your identity and prevent fraud
- Use automated tools for clinical risk scoring and decision support to assist healthcare providers; these tools support provider judgment and do not make final clinical determinations
- Send transactional or service-related communications
- Serve random, non-targeted advertising as described in the Advertising section above
- Comply with applicable law, judicial orders, and law enforcement requirements
- Perform Platform analytics and product development
- Run our general business operations
De-identification and Aggregation
Compass may de-identify, anonymize, and aggregate data submitted through the Platform to generate de-identified data for analytics, research, product improvement, and benchmarking, consistent with applicable law. De-identified data does not identify any individual patient or user and is not subject to this Privacy Notice once de-identified.
Sale of the Business
If we sell all or part of our business, Personal Information may be transferred to the purchaser in connection with that transaction. We will use reasonable efforts to include contractual provisions requiring the purchaser to treat your Personal Information consistently with this Privacy Notice.
Other Disclosures
We may disclose Personal Information as permitted or required by law, for safety purposes, to protect our legal rights, to enforce our Terms of Use, or to respond to subpoenas or legal process. We may also disclose Personal Information to our auditors or legal advisors. Access to Personal Information is restricted to individuals who need it to fulfill their job responsibilities.
Your Privacy Rights
Certain jurisdictions confer specific privacy rights on individuals. We will address those rights as required by applicable law. If you wish to exercise any of the following rights, please contact us as specified in the Contact Information section below.
You have the right to know: (1) what categories of Personal Information concerning you are being processed; (2) the purpose for processing; (3) how to exercise your rights, including how to appeal a decision; (4) the categories of Personal Information shared with third parties, if any; and (5) the categories of those third parties.
To submit a request, contact us at info@mhds.ai. We will respond within 45 days of receipt, or within a different period as required by applicable state law. We may verify your identity before processing your request. If we decline to act on your request, you have the right to appeal by contacting us at info@mhds.ai and identifying your original request and the basis for your appeal. We will respond within the timeframes required by applicable law.
Security
We have implemented reasonable and appropriate measures to secure your Personal Information from accidental loss and from unauthorized access, use, alteration, and disclosure. We cannot, however, guarantee the security of information transmitted to or from the Platform.
Data Retention
We retain Personal Information for as long as necessary to fulfill the purposes for which it was collected and as required by applicable law and our contractual obligations. For PHI processed on behalf of healthcare providers, retention is governed by applicable federal and state health records laws, including HIPAA and applicable state medical records statutes, as well as our agreements with those providers. For other Personal Information, we retain data only as long as necessary for the business purposes described in this Privacy Notice. When Personal Information is no longer needed, we delete or de-identify it in accordance with our data retention policies, unless law or contract requires longer retention.
Changes to This Privacy Notice
We may amend this Privacy Notice from time to time. If we make any material change in how we collect, use, disclose, or otherwise process Personal Information, we will prominently post an updated Privacy Notice. Changes are effective immediately upon posting or as otherwise required by applicable law.
Contact Information
To ask questions or comment about this Privacy Notice and our privacy practices, contact us at:
Mental Health Data Services, Inc.
1600 Market Street, Suite 1501
Philadelphia, PA 19103
info@mhds.ai