Privacy Policy
Last Updated: July 21, 2026
Legacy ("Legacy," "we," "our," or "us") provides an artificial intelligence assistant that captures and analyzes interactions between clinicians and patients to generate actionable insights (the "Services"). This Privacy Policy explains how we collect, use, disclose, and protect information in connection with the Services.
This Privacy Policy should be read together with our Terms of Service. Capitalized terms that are not defined here have the meaning given to them in the Terms of Service. If there is a conflict between this Privacy Policy and an applicable Order Form, Supplemental Terms, or Business Associate Agreement, those documents will control to the extent of the conflict.
Scope and who this applies to
The Services are provided to organizations such as health systems, clinical practices, and other business customers ("Customers"). Our direct relationship is with the Customer, not with the individual patients, clinicians, or other end users whose information may be processed through the Services.
Much of the information processed through the Services is submitted, controlled, or generated by our Customers. Where we process information on a Customer's behalf, we do so under the direction of that Customer and subject to our agreement with them. If you are a patient, clinician, or other individual and you have questions about how your information is handled, please contact the Customer organization that uses our Services (for example, your health system or provider).
Information we collect
We collect the following categories of information in connection with the Services.
Account and contact information.
When a Customer creates an account or enters into an Order Form, we collect information such as names, work email addresses, job titles, organization details, and access credentials for the individuals authorized to use the Services.
Customer Data.
In the course of providing the Services, we process the information, data, content, and files that Customers and their users transmit, upload, or store through the Services ("Customer Data"). Because of the nature of the Services, Customer Data may include recordings, transcripts, and analyses of clinician and patient interactions, information relating to goals-of-care and advance care planning conversations, and other health-related information about patients. The Customer determines what Customer Data is submitted to the Services and is responsible for having the rights, notices, consents, and permissions necessary for us to process it.
Usage and technical data.
We generate and collect information about how the Services are accessed and used, including log data, device and browser information, IP addresses, timestamps, feature usage, and diagnostic and performance information. We refer to this and other information derived from the operation of the Services as "Usage Data."
Information from third parties
We may receive information from Third-Party Service Providers that the Services rely on or integrate with, and from our Customers about their authorized users.
How we use information
We use the information we collect to:
provide, operate, maintain, support, monitor, and secure the Services;
analyze and improve the Services and develop new features, products, and services;
communicate with Customers and their users about their accounts, including service-related notices and support;
detect, prevent, and address fraud, abuse, security incidents, and other harmful or unlawful activity;
perform research, analytics, and product development; and
comply with applicable laws and legal obligations, including responding to lawful requests from courts, regulators, and law enforcement.
We process Customer Data primarily to deliver the Services to the applicable Customer and as otherwise permitted under our Terms of Service and any applicable Business Associate Agreement. We own and retain rights in Usage Data as described in our Terms of Service, and we may use Usage Data for the purposes described above.
Artificial intelligence and automated processing
Certain features of the Services use artificial intelligence models and related technology ("AI Tools") to analyze interactions and generate text, insights, suggestions, and other output. Some of these AI Tools are provided by third parties.
Providing the Services through AI Tools may involve access to Customer Data by third-party AI providers, and those providers, along with Legacy, may use Customer Data to operate, train, improve, and develop the underlying technologies and the Services, subject to applicable law and to any restrictions in an Order Form or Business Associate Agreement. Where health information is involved, this processing is governed by the applicable Business Associate Agreement and applicable law.
Output generated by AI Tools is automated and may be inaccurate, incomplete, or otherwise unreliable. As described in our Terms of Service, AI output is not a substitute for professional or medical judgment.
How we share and disclose information
We do not sell Customer Data. We may share and disclose information as follows.
With Third-Party Service Providers.
We share information with vendors and service providers that help us operate and deliver the Services, including cloud hosting, infrastructure, analytics, and AI providers. These providers are authorized to use the information only to perform services for us.
With the applicable Customer.
We make Customer Data and related output available to the Customer that submitted it and to that Customer's authorized users.
For legal and safety reasons.
We may disclose information when we believe it is reasonably necessary to comply with a law, regulation, legal process, or governmental request; to enforce our Terms of Service; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of Legacy, our Customers, or others.
In connection with a business transaction.
. If Legacy is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, information may be transferred as part of that transaction, subject to appropriate confidentiality protections.
With consent or at the Customer's direction.
We may share information for other purposes with the relevant Customer's authorization or at the Customer's direction.
Health information and HIPAA
To the extent Legacy processes protected health information (as defined under the Health Insurance Portability and Accountability Act, "HIPAA") on behalf of a Customer that is a covered entity or business associate, Legacy acts as a business associate. In that case, our handling of that information is governed by a Business Associate Agreement between Legacy and the Customer, and the terms of that agreement control to the extent they conflict with this Privacy Policy. Legacy is not a healthcare provider, does not provide medical advice, and the Services are non-diagnostic.
Data retention
We retain information for as long as needed to provide the Services, for the period set out in the applicable Order Form or Business Associate Agreement, and thereafter as necessary to comply with our legal obligations, resolve disputes, enforce our agreements, and for legitimate business purposes. Retention and deletion of Customer Data are also subject to the terms of our agreement with the applicable Customer.
Security
We maintain administrative, technical, and organizational measures designed to protect information against unauthorized access, use, alteration, and destruction. No method of transmission or storage is completely secure, however, and we cannot guarantee the absolute security of information. Customers are responsible for safeguarding their access credentials and for the security measures within their control, as described in our Terms of Service.
Your choices and rights
Depending on where you are located and applicable law, you may have rights regarding your personal information, such as the right to access, correct, delete, or restrict certain processing, and the right to receive a copy of certain information.
Because much of the information we process is Customer Data that we handle on behalf of our Customers, we will generally direct requests concerning that information to the applicable Customer, who acts as the controller of that data. If you are an individual whose information is processed through the Services, please direct your request to the Customer organization that uses our Services. We will support our Customers in responding to such requests as required by applicable law and our agreements with them.
For residents of California and other jurisdictions with applicable privacy laws, we do not sell personal information and do not share it for cross-context behavioral advertising. To exercise rights with respect to information Legacy controls, or to ask a question, contact us using the details below.
International data transfers
We are based in the United States and may process and store information in the United States and other countries. Where information is transferred across borders, we take steps to ensure it receives an adequate level of protection as required by applicable law.
Children's privacy
The Services are directed to Customer organizations and their authorized users, not to individuals under the age of 18, and we do not knowingly collect personal information directly from children. Customer Data may include information about patients of any age, which is submitted and controlled by the Customer and processed under our agreement with that Customer and applicable law.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The "Last Updated" date above indicates when it was last revised. If we make material changes, we may provide notice through the Services, by email, or by other reasonable means. Continued use of the Services after an update takes effect confirms acceptance of the revised Privacy Policy.
Contact us
If you have questions about this Privacy Policy or our privacy practices, please contact us at:
Legacy Email: contractor@legacytheapp.com