Privacy Policy

1. Who We Are and Scope

This Privacy Policy describes how MASE Health ("MASE," "we," "us") collects, uses, stores, and discloses information through the MASE EMR web application at www.mase-emr.com, the MASE OS mobile app (Apple bundle identifier health.mase.os), and the related electronic health record (EHR), practice management, billing, and patient portal services (the "Services").

MASE EMR and MASE Health OS are operated by Serenity Rehabilitation Center, Inc.

MASE provides the Services to healthcare organizations ("Customers" or "provider organizations"). For clinical data, MASE acts as a Business Associate of the Customer under HIPAA, and the Customer is the Covered Entity responsible for the patient relationship. If you are a patient, your provider's Notice of Privacy Practices explains how your provider uses your health information; this policy explains how MASE handles data on the provider's behalf.

Contact us at info@mase.health or +1 248-681-1211.

2. Information We Collect

We collect the following categories of information:

• Account and contact information: name, work email, phone number, role, license and credential details, organization, and authentication data such as hashed credentials, PIN and multi-factor verification status.
• Patient health and intake information: patient demographics, clinical documentation, intake responses, assessments, diagnoses, medications and dosing records, laboratory results, appointments, insurance and billing information, and other data entered by you or your provider organization.
• Consents and signatures.
• Photos.
• Optional facial biometrics and location: used for check-in verification only, and only when you consent.
• Device and usage data: device type, operating system, app version, log data, IP address, browser type, pages viewed, and audit trail events (such as who viewed or changed a record and when).
• Communications: messages, support requests, and sales inquiries you send us, and records of notifications, emails, or text messages sent through the Services.
• Payment information: billing details for subscriptions, processed by our payment processor. We do not store full card numbers.

3. How We Use Information

We use information to:

• Deliver care, including clinical documentation, treatment workflows, and communication with the provider organization.
• Verify check-in when facial biometrics or location are used with consent.
• Support diversion control for medications handled by the provider organization.
• Operate, secure, and support the Services, including role-based access and audit logs.
• Support claims submission, eligibility checks, and other billing and payment operations.
• Send service notices, security alerts, and appointment or workflow notifications.
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our agreements.
• Improve the Services using aggregated or de-identified data that meets HIPAA de-identification standards.

Artificial intelligence features, including the Eva voice assistant, process information in order to provide those features. We do not sell personal information or protected health information. We do not use advertising tracking, and we do not use protected health information for advertising or marketing.

4. Protected Health Information, HIPAA, and 42 CFR Part 2

We are committed to protecting health information in accordance with the HIPAA Privacy, Security, and Breach Notification Rules. PHI is handled under HIPAA, our Business Associate Agreement with each Customer, and applicable state law. We use and disclose PHI only as permitted by that agreement and by law.

Substance use disorder (SUD) treatment records are handled in accordance with 42 CFR Part 2, which can impose stricter consent and redisclosure requirements. The Services support consent capture and access controls so Customers can meet these obligations. Customers are responsible for obtaining the consents required for their disclosures.

5. How We Share Information

We share information only in these circumstances:

• With the provider organization: data entered in the Services is available to authorized users of the Customer that uses MASE to deliver care.
• Service providers under business associate agreements: vendors that are required to host infrastructure, store data, send messages, process payments, or support clearinghouse and e-prescribing workflows. Vendors that handle PHI are bound by written agreements, including business associate agreements when those agreements are required.
• At the Customer's direction: for example, submitting claims to payers or exchanging records with a health information exchange.
• When required by law: including a subpoena or court order, or to protect the rights, safety, and security of individuals or the Services, in each case consistent with HIPAA and Part 2.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to the same privacy protections.

SMS / Text Messaging

MASE EMR / MASE Health OS, operated by Serenity Rehabilitation Center, Inc., sends text messages for the program MASE Eva Sales recap from +1 (248) 919-5856.

We collect phone numbers from callers who verbally agree to receive a text recap of that call. The message is a recap of the sales conversation. Message frequency is one message per call. Message and data rates may apply.

Reply STOP to opt out. Reply HELP for help. For support, call (248) 919-5856 or visit https://www.maseneural.io.

Mobile numbers and SMS opt-in consent are never shared or sold to third parties or affiliates for marketing purposes.

SMS program rules are also described in our Terms of Service.

6. Security

We maintain administrative, physical, and technical safeguards designed to protect information against unauthorized access, use, or disclosure. Access is limited to people and services that need the information to perform their work. Safeguards include encryption in transit and at rest, role-based access control, multi-factor and PIN-based identity verification for sensitive actions, session controls, and audit logging of access to records. No system is perfectly secure. If a breach affecting PHI occurs, we will notify the affected Customer and take other steps as required by HIPAA and applicable law.

7. Data Retention

We keep information for as long as needed to provide the Services, follow the provider organization's instructions, and meet applicable legal and clinical record requirements. Clinical records are retained according to the Customer's service agreement and applicable federal and state record-retention requirements. Account and log data are kept for as long as the account is active and for a period afterward as needed for legal, security, and audit purposes. When a Customer relationship ends, data is returned or securely destroyed as set out in the Business Associate Agreement. When information is no longer needed, we delete it or de-identify it.

8. Your Rights and Choices

You may request access to, correction of, or deletion of your information. Patients and staff should send the request through their provider organization, or contact MASE Health at info@mase.health. Patients have rights under HIPAA to access, request amendment of, and receive an accounting of disclosures of their health information, and to request restrictions or confidential communications. Because MASE acts on behalf of your provider, please send medical-record requests to your provider's privacy office. We will assist the provider in responding. We may need to confirm your identity. Some information must be kept to meet legal or clinical record duties, and a deletion request applies to information we are permitted to delete.

Website visitors and account holders may contact us to access, correct, or delete the personal information that is not part of a medical record, subject to legal retention requirements. Residents of certain states may have additional rights under state privacy laws; these laws generally do not apply to PHI already covered by HIPAA.

9. Cookies and Similar Technologies

We use cookies and similar technologies that are necessary to sign you in, keep your session secure, and remember basic preferences. We do not use advertising cookies, and we do not place tracking technologies that share PHI with advertising or analytics platforms on authenticated pages.

10. Children's Privacy

MASE EMR and MASE OS are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information, contact us and we will take steps to delete it. Records of minor patients are entered and managed by the treating provider and are protected as PHI.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The updated policy will be posted at this page. The "Last updated" date above shows when it was last revised. Material changes will be communicated to Customers through the Services or by email.

12. Contact Us

MASE Health
info@mase.health
+1 248-681-1211

For privacy questions or to exercise your rights, contact us at the address above. To report a suspected privacy or security incident, include as much detail as possible so we can respond promptly.