Compliance and Privacy: Sixmonth

Healthcare Information Notice

sixmonth provides technology to healthcare organizations, including tools that may help authorized teams identify patient follow-up, recall, scheduling, and care-coordination opportunities. Depending on how a customer configures the Services, information processed for that customer may include patient identity, contact information, appointment history, treatment-related information, insurance information, clinical notes, communications, and other information maintained by the customer.

Our customers remain responsible for their patient relationships, clinical decisions, legal notices, authorizations, and use of the Services. sixmonth does not replace a healthcare professional’s judgment and does not independently diagnose, prescribe, or direct patient care.

Where sixmonth receives protected health information (“PHI”) from or on behalf of a U.S. covered entity or business associate, we process that PHI only as permitted by the applicable business associate agreement (“BAA”), customer instructions, and law. If you are a patient seeking access to, correction of, or deletion of information held by your healthcare provider, contact that provider directly. We will support our customer in responding where required.

Do not send sensitive health information through ordinary email or a general website form.
Use only a secure channel approved by sixmonth or your healthcare provider.

Information We Collect

We collect information in three primary ways: information you provide, information collected through use of the Services, and information customers direct us to process.

Information you provide directly

Account and professional information: name, business email, telephone number, organization, role, login credentials, and account preferences.
Commercial information: subscription details, billing contacts, invoices, transaction records, and contract information.
Communications: support requests, survey responses, product feedback, demo requests, event registrations, and correspondence with us.
Content: information you upload, enter, or otherwise submit to the Services.

Information collected automatically

Device, browser, operating system, IP address, approximate location derived from IP, language, and time zone.
Log and usage data, such as pages viewed, features used, actions taken, timestamps, session information, referring URLs, and diagnostic events.
Cookies and similar technologies used for essential operations, security, preferences, analytics, and, where permitted, marketing.

Information processed for customers

Customers may connect systems or provide data that includes patient records, appointment and scheduling information, communications, treatment or procedure information, insurance details, clinical and operational notes, and related metadata. We process this customer-controlled information to provide the Services and according to the customer’s instructions.

When you sign up for Off-Chair, our weekly newsletter, we collect your email address, your first name if you give it, the role you select, your consent, and the page you signed up from. Newsletter subscriber data is stored with Kit (kit.com), the email service provider that sends Off-Chair on our behalf, and is used to confirm your subscription, deliver the newsletter, and understand which issues are read. We do not sell it or use it for any other mailing list. Each issue carries an unsubscribe link, and you can ask us to delete your subscriber record at any time by writing to Privacy@sixmonth.ai. Answers you send to cases featured in an issue may be anonymized and used to improve dental AI, including our own.

We seek to collect only information that is reasonably necessary for legitimate, disclosed purposes.

How We Use Information

We use information to:

Deliver, operate, maintain, configure, and support the Services.
Authenticate users, administer accounts, and enforce permissions.
Process transactions and manage customer relationships.
Respond to support requests, investigate problems, and communicate service information.
Secure the Services, detect abuse, prevent fraud, maintain auditability, and protect users, customers, patients, and sixmonth.
Measure performance, understand product usage, and improve reliability and user experience.
Develop and test features using safeguards appropriate to the sensitivity of the data.
Comply with legal obligations, respond to lawful requests, enforce agreements, and establish or defend legal claims.
Send marketing communications where permitted. You may unsubscribe at any time, although operational messages may continue.

Where applicable law requires a legal basis, we rely on performance of a contract, compliance with legal obligations, legitimate interests, consent, or another basis recognized by law. The applicable basis depends on the context and category of information.

We do not sell personal information for money. We do not use PHI for advertising. If a jurisdiction defines “sale,” “sharing,” or targeted advertising more broadly, we provide legally required notices and choices.

AI, Machine Learning & Analytics

sixmonth may use artificial intelligence, machine learning, statistical methods, and analytics to support authorized workflows, such as organizing information, identifying potential follow-up opportunities, prioritizing work, improving search and retrieval, generating summaries, assisting with communications, detecting anomalies, and improving service quality.

Our approach is guided by the following principles:

Purpose limitation: customer-controlled data is used to provide and secure the Services under customer instructions and applicable agreements.
Human responsibility: AI-generated outputs may be incomplete or incorrect and must be reviewed by appropriately authorized personnel before consequential action is taken.
No autonomous clinical decision-making: the Services do not replace professional judgment, and customers are responsible for clinical and operational decisions.
Data minimization: we seek to limit data used by each workflow to what is reasonably necessary.
Evaluation and monitoring: we may test quality, reliability, security, and performance and implement controls designed to reduce harmful or unintended outcomes.
Contractual controls: third-party providers that support AI or infrastructure functions are subject to contractual and security requirements appropriate to their role.

We do not use PHI to train generalized models. We do not permit an AI provider to use PHI for its own model training when the provider is processing PHI for the Services. Where feasible and appropriate, we use de-identified, aggregated, synthetic, or otherwise protected information for evaluation and improvement.

How We Disclose Information

We may disclose information only as reasonably necessary for the purposes described in this Policy, including to:

Service providers and subprocessors that provide cloud hosting, infrastructure, security, communications, analytics, customer support, payment, and professional services.
Customer-authorized users and integrations based on the customer’s configuration, permissions, and instructions.
Professional advisers, such as lawyers, auditors, accountants, insurers, and financial institutions, subject to appropriate duties of confidentiality.
Authorities and other parties when required by law or when reasonably necessary to protect rights, safety, security, and the integrity of the Services.
Transaction participants in connection with a financing, merger, acquisition, restructuring, or sale of all or part of our business, subject to appropriate confidentiality protections.
Other recipients when you direct us, authorize the disclosure, or provide consent.

We contractually limit service providers to authorized purposes and require protections appropriate to their role. Before a subprocessor may create, receive, maintain, or transmit PHI, we require a BAA or another legally permitted arrangement where HIPAA requires one. We do not permit service providers to use PHI for their own advertising or model training.

De-Identified & Aggregated Data

We may create and use information that has been de-identified, aggregated, or transformed so that it cannot reasonably be linked to an identified or identifiable individual. We may use this information to operate, secure, analyze, benchmark, research, and improve the Services and to understand broader operational patterns.

When required by applicable law, we maintain de-identified information in de-identified form and do not attempt to re-identify it, except to test whether our de-identification methods are effective or as otherwise permitted by law. We expect recipients of de-identified information to comply with equivalent restrictions.

De-identification of PHI is performed only as allowed by HIPAA, an applicable BAA, customer instructions, and other applicable requirements.

Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, satisfy contractual commitments, comply with law, resolve disputes, maintain security records, and enforce agreements.

Retention periods vary based on:

The type, sensitivity, and volume of information.
The purpose for which the information was collected or processed.
Customer instructions and contractual requirements.
Legal, regulatory, tax, accounting, security, and claims-related obligations.
Whether deletion or de-identification is technically and legally appropriate.

Customer-controlled data is returned, deleted, retained, or de-identified according to the applicable agreement and customer instructions. Residual copies may remain for a limited period in protected backups, security logs, or records that must be preserved by law.

Security

We maintain administrative, technical, and organizational safeguards designed to protect information against unauthorized access, use, alteration, loss, or disclosure. Depending on the Services and risk, these safeguards may include:

Identity and access management, least-privilege access, and authentication controls.
Encryption in transit and, where appropriate, at rest.
Environment separation, logging, monitoring, vulnerability management, and incident response procedures.
Vendor diligence and contractual security requirements.
Workforce confidentiality, security awareness, and access controls.
Business continuity, backup, recovery, and change-management practices.

Our primary U.S. production environment is hosted in the United States and uses controls that include network separation, managed encryption, encrypted production databases and object storage, centralized security monitoring and alerts, access logging for designated patient-record workflows, and backup and recovery procedures. Features and customer- selected integrations can involve other providers or locations. The applicable order form, BAA, and subprocessor documentation define which services are authorized to handle PHI.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we work to identify risk, improve controls, and respond appropriately to suspected incidents. If you believe information or an account may have been compromised, contact us promptly at Privacy@sixmonth.ai.

Your Privacy Rights

Depending on your location and our role, you may have the right to:

Request access to personal information we hold about you.
Request correction of inaccurate personal information.
Request deletion of personal information.
Request restriction of or object to certain processing.
Receive a portable copy of certain information.
Withdraw consent where processing relies on consent.
Opt out of certain marketing, targeted advertising, sale, sharing, or profiling activities.
Appeal a decision we make about a privacy request.
Lodge a complaint with a competent data protection authority.

To exercise a right, contact us using the details below and describe your request. We may verify your identity and authority before acting. Authorized agents may submit requests where permitted by law, subject to verification.

If your request concerns information controlled by a sixmonth customer, contact that customer directly. We will assist the customer as required by law and contract. We will not discriminate against you for exercising a privacy right.

U.S. State Privacy Rights

Residents of certain U.S. states may have additional rights under state privacy laws. Subject to exceptions and our role, these may include rights to know, access, correct, delete, and obtain a portable copy of personal information, as well as rights to opt out of sale, sharing, targeted advertising, or certain profiling.

Categories of information

The categories we may process include identifiers; customer records; commercial information; internet or network activity; geolocation derived from IP; professional information; inferences; communications; and sensitive information, including health information, when provided by or for a customer.

Sources and purposes

We receive information from you, our customers, authorized integrations, service providers, and use of the Services. We use and disclose it for the business and commercial purposes described in this Policy.

Choices

sixmonth does not sell personal information for money. We do not knowingly sell or share personal information of children for targeted advertising. Where cookies or similar technologies constitute “sharing,” targeted advertising, or a “sale” under applicable law, we will provide required controls.

You may submit a request or appeal by contacting us. We may retain a limited record of the request to demonstrate compliance.

Consumer Health Data

Certain U.S. state laws regulate “consumer health data” beyond information covered by HIPAA. To the extent such laws apply to sixmonth as a regulated entity, this section supplements the rest of this Policy.

Consumer health data may include information that identifies or could reasonably be linked to a consumer and that reveals or can be used to infer physical or mental health status, treatment, diagnosis, medication, reproductive or sexual health, biometric information, precise location associated with health services, or efforts to seek health services.

We may collect consumer health data directly from you, from customers acting at your direction or in connection with services you receive, from authorized integrations, or from your use of the Services. We process it only for purposes described in this Policy, to provide a product or service you requested, with consent where required, or as otherwise permitted by law.

We may disclose consumer health data to processors and service providers, customer-authorized recipients, transaction participants, and authorities as described in this Policy. We do not sell consumer health data without the legally required authorization. Where applicable, you may request access, correction, deletion, or withdrawal of consent and may appeal a denied request.

See Exhibit A: Consumer Health Data Notice below for additional details.

Children's Privacy

The sixmonth website and business Services are not directed to children, and we do not knowingly collect personal information directly from children through the website for independent commercial purposes.

Our customers may use the Services to process information concerning minor patients. In those circumstances, sixmonth processes the information on behalf of the customer, under the customer’s instructions and applicable agreements. Parents, guardians, and eligible minors should direct requests concerning provider-held patient records to the relevant healthcare provider.

If you believe a child submitted personal information directly to us outside a customer-directed healthcare context, contact us so we can assess and take appropriate action.

International Users

Information may be processed in countries other than the country where it was collected. Those countries may have data protection laws that differ from the laws where you live.

Where required, we use recognized safeguards for international transfers, which may include adequacy decisions, standard contractual clauses, contractual commitments, transfer risk assessments, and supplementary technical or organizational measures.

Individuals in the European Economic Area, United Kingdom, and Switzerland may have rights described in Your Privacy Rights. They may also contact their local supervisory authority. Our legal basis for processing depends on the context and may include contract, legitimate interests, legal obligations, consent, or protection of vital interests.

Third-Party Websites

The Services may link to third-party websites, applications, integrations, or services. Their privacy and security practices are governed by their own terms and policies, not this Policy. A link does not mean that sixmonth endorses or controls the third party.

Review the third party’s privacy notice before providing information or enabling an integration. Customers are responsible for deciding which integrations to connect and for configuring access appropriately.

Changes to This Policy

We may update this Policy to reflect changes in our Services, practices, technology, or legal obligations. We will post the updated Policy and revise the “last updated” date. If a change materially affects how we use information, we will provide additional notice or obtain consent where required.

Your continued use of the Services after an update takes effect is subject to the updated Policy, except where law requires a different form of notice or consent.

HIPAA Notice

HIPAA applies only in specific circumstances. When sixmonth acts as a business associate to a HIPAA-covered entity or another business associate, our handling of PHI is governed by HIPAA, the applicable BAA, and customer instructions.

A BAA must be executed before PHI is submitted to the Services. PHI may be processed only through the HIPAA-eligible Services, configurations, and subprocessors identified in the applicable agreement. A customer must not enable an integration for PHI unless the integration has been approved for that purpose. Services used without a BAA, and public website forms or ordinary email, are not intended for PHI.

In that role, sixmonth may use and disclose PHI to provide the contracted Services; administer and manage our obligations where permitted; support security, incident response, and compliance; and perform other activities authorized by the BAA or law. We apply safeguards designed to protect the confidentiality, integrity, and availability of electronic PHI and require applicable subcontractors to accept appropriate restrictions and conditions.

sixmonth is not the healthcare provider maintaining your medical record. To exercise HIPAA rights concerning a designated record set, including access or amendment, contact your healthcare provider or health plan. sixmonth will assist the relevant customer as required by the BAA and law.

Contact Us

For privacy questions, rights requests, or security concerns, contact:

IOLOKIS SAS, sixmonth.ai Privacy
60 rue François Ier, 75008 Paris, France
SIREN: 943 709 089 · SIRET: 943 709 089 00016
Website: sixmonth.ai
Email: Privacy@sixmonth.ai

Please include “Privacy Request” in the subject line and do not include sensitive health information in ordinary email.

We may ask for information reasonably necessary to verify your identity, locate relevant records, understand your request, and protect against fraudulent requests.

Exhibit A · Consumer Health Data Notice

This Exhibit applies where a consumer health privacy law requires a separate notice and sixmonth acts as a regulated entity rather than solely as a processor for a customer.

Consumer health data we may collect

Depending on your interaction with the Services, we may process information concerning health conditions, symptoms, diagnoses, treatments, procedures, medications, appointments, insurance, communications with a healthcare organization, or inferences derived from such information. We may also process identifiers necessary to associate information with the correct person.

Why we collect and use it

We may process consumer health data to provide requested Services; enable customer-authorized care coordination and operational workflows; secure and troubleshoot the Services; comply with law; and perform other activities with consent or as permitted by law.

Sources

Sources may include you, healthcare organizations and their authorized personnel, systems connected by a customer, service providers, and information generated through authorized use of the Services.

Disclosures

We may disclose consumer health data to the healthcare organization directing the processing; its authorized users and integrations; processors necessary to operate and secure the Services; advisers and transaction participants under confidentiality protections; and authorities where required or permitted by law.

Your choices

Where applicable, you may request access, correction, or deletion; withdraw consent; obtain a list of certain third-party disclosures; or appeal a denied request. Contact us using the details above. If sixmonth processes the information solely for a healthcare organization, submit the request to that organization.

Exhibit B · SMS/Text Messaging

If you provide a mobile number or agree to receive text messages in connection with the Services, the following terms apply:

We or a customer using the Services may send operational, appointment-related, support, authentication, or other authorized messages.
Message frequency varies. Message and data rates may apply.
Consent to receive marketing text messages is not a condition of purchasing a product or service, where prohibited by law.
Reply STOP to opt out of messages from the applicable sender. Reply HELP for help. Opt-out requests may take a short period to process, and you may receive a final confirmation message.
Carriers are not liable for delayed or undelivered messages.
Mobile information and text-message consent are not sold. We do not disclose them to third parties for their own direct marketing, except as required to operate the messaging service or as permitted by law.

For text-message privacy questions, contact the sender identified in the message or email Privacy@sixmonth.ai.

Your trust is part of our infrastructure