BOXI.AI PRIVACY POLICY

1. INTRODUCTION AND ACCEPTANCE

At Boxi.ai, we take your privacy seriously. As a startup service, we are committed to developing our privacy practices to protect your information while providing valuable services. Please read this Privacy Policy carefully to understand our practices regarding your personal data.

By accessing, browsing, or using the Service in any way, including but not limited to visiting or browsing our website, contributing content or information, filling out any forms, communicating with any chatbots or AI agents, or registering for an account, YOU ARE AGREEING TO BE BOUND BY THIS PRIVACY POLICY. If you disagree with any part of this Privacy Policy, you must not access or use the Service in any way. No additional consent or express acceptance is required - your continued use or interaction with any aspect of the Service constitutes your binding legal acceptance of this Privacy Policy in its entirety.

We recognize that our Service may be used to handle sensitive information, including health-related communications. This Privacy Policy explains our commitment to protecting such information while acknowledging the inherent limitations of a developing platform.

2. INFORMATION WE COLLECT

2.1 Information You Provide to Us

We may collect the following types of information when you register for or use our Service:

a) Account Information: Name, email address, phone number, password, and other registration information.

b) Profile Information: Information you add to your profile, such as profile picture, preferences, and settings.

c) Communication Content: Information you input when using our communication and notification features, which may include:

• Messages to or about other individuals
• Notification content and scheduling
• Health-related information about yourself or others
• Reminder content, including potential medication or appointment reminders
• Wellness check information
• Phone numbers and the consent record (including verbal consent captured on a recorded call) that authorizes us to send SMS

d) Payment Information: If applicable, billing details and transaction information.

2.2 Information We Collect Automatically

When you use our Service, we may automatically collect:

a) Usage Information: Data about how you interact with our Service, including:

• Features you use
• Actions you take
• Time, frequency, and duration of your activities

b) Device Information: Information about the device you use to access our Service, including:

• Device type and model
• Operating system
• Browser type
• Mobile network information
• IP address

c) Location Information: General location information based on IP address or more precise location if you grant permission.

d) Cookies and Similar Technologies: We use cookies and similar tracking technologies to collect information about your browsing activities and to distinguish you from other users of the Service.

When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.

3. SMS / TEXT MESSAGING COMMUNICATIONS AND CONSENT

This section describes, in plain language, how Boxi.ai sends SMS (text) messages and how we obtain consent to do so. We provide this information so that you, and any third party reviewing our SMS practices, can clearly understand how our text messaging program works.

3.1 Who Sends the Messages

Boxi.ai may send SMS messages directly under the Boxi.ai brand, and may also send SMS on behalf of its healthcare clients (such as clinics, medical practices, and other provider organizations) acting as their service provider.

3.2 What the Messages Contain

SMS messages sent by or through Boxi.ai are limited to communications related to a service the recipient or their healthcare provider has requested, including: appointment reminders, confirmations, reschedule and cancellation notices, intake and pre-visit instructions, follow-up and wellness check-ins, and account or service notifications. We do not sell SMS data, and we do not share mobile phone numbers or SMS consent information with third parties for their own marketing.

3.3 How Consent Is Collected

We only send SMS messages to individuals who have opted in. Consent is obtained in one of the following ways:

a) Verbal opt-in during a phone call with a Boxi.ai voice agent. During the call, the agent explicitly asks the person whether they would like to receive a text message (for example, to confirm an appointment, send a link, or follow up). If the person agrees, the agent confirms the mobile number on the call, and a confirmation SMS is then sent to that number. The call is recorded and the verbal consent is logged with a timestamp.

b) Web or app opt-in. On a Boxi.ai website or web/mobile application, by entering a mobile number and submitting a form, checkbox, or other clear affirmative action indicating that SMS messages will be sent.

c) Through a Boxi.ai client. Through the clinic, practice, or provider with whom you have an existing relationship, where the client has captured your consent (for example at intake, in their patient portal, or through their own opt-in process) and has authorized Boxi.ai to send SMS on their behalf.

3.4 Message Frequency and Cost

Message frequency varies depending on the appointments, services, or follow-ups involved. Message and data rates may apply from the recipient's mobile carrier.

3.5 Carrier Disclaimer

Mobile carriers are not liable for delayed or undelivered messages.

3.6 Recordkeeping

Boxi.ai retains a record of when and how consent was obtained - including call recordings or transcripts for verbal consent, and form submissions for web or app consent - for the period required by applicable law and applicable carrier and 10DLC rules.

4. HOW WE USE YOUR INFORMATION

We use the information we collect for various purposes, including:

a) Providing and Improving the Service:

• Operating and maintaining the Service
• Developing new features and functionality
• Understanding how users interact with our Service
• Improving user experience

b) Facilitating Communications:

• Enabling notifications and reminders as requested
• Facilitating communication between users
• Processing wellness checks and related notifications

c) Customer Support:

• Responding to your inquiries and requests
• Troubleshooting issues
• Providing technical support

d) Security and Compliance:

• Protecting the security and integrity of our Service
• Preventing fraudulent or unauthorized activity
• Complying with legal obligations

e) Marketing and Communication:

• Sending service-related communications
• Providing updates about new features or services
• Marketing our products and services (with your consent where required)

5. HEALTH-RELATED INFORMATION

4.1 Not Covered by HIPAA

Boxi.ai is not a healthcare provider, medical service, or "covered entity" under the Health Insurance Portability and Accountability Act (HIPAA). The health-related information you provide through our Service is not protected under HIPAA regulations but is subject to the protections described in this Privacy Policy.

4.2 Use of Health-Related Information

If you choose to use our Service for health-related purposes, such as medication reminders, wellness checks, or other health monitoring, we will:

a) Use such information solely for the purpose of providing the requested services.

b) Limit access to such information to authorized personnel necessary to operate and maintain the Service.

c) Not use such information for marketing purposes without your explicit consent.

However, as a startup service, we are continuously developing our privacy and security measures. You should exercise caution when inputting sensitive health information into our Service.

6. INFORMATION SHARING AND DISCLOSURE

5.1 Information Sharing with Your Consent

We may share your information with third parties when you direct us to do so or provide consent, such as when you choose to share information with emergency contacts or caregivers through our Service.

5.2 Service Providers

We may share your information with third-party vendors, consultants, and other service providers who need access to such information to carry out work on our behalf, such as:

a) Cloud hosting and data storage providers

b) Payment processors

c) Analytics services

d) Customer support services

e) Marketing and communication services

All service providers are required to use your personal information only as necessary to provide services to us and are bound by contractual obligations to keep your personal information confidential and secure.

5.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

5.4 Business Transfers

If we are involved in a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website of any change in ownership or uses of your personal information.

5.5 With Your Consent

We may share your information with third parties when you explicitly consent to such sharing.

7. DATA SECURITY

We implement reasonable security measures in our sole discretion to protect your information. However, as a startup service in development, we EXPLICITLY DO NOT GUARANTEE any level of security, data integrity, or protection against unauthorized access, alteration, disclosure, or destruction of your information. ANY METHOD of electronic storage or transmission over the internet is inherently insecure and vulnerable to various forms of attack or compromise.

6.1 Security Measures

Our security measures may include, but we make no guarantees or representations regarding:

a) Encryption of sensitive data in transit and at rest

b) Security assessments and testing

c) Access controls and authentication mechanisms

d) Monitoring for suspicious activities

6.2 Startup Limitations and Your Explicit Acknowledgment

As a developing platform, you explicitly acknowledge and accept that:

a) Our security measures are rudimentary, unproven, and continuously evolving.

b) There ARE significant limitations in our current security infrastructure.

c) SUBSTANTIAL SECURITY VULNERABILITIES may exist in our systems.

d) By using our Service, you ASSUME ALL RISKS associated with providing your information to a startup platform with developing security practices.

e) We reserve the right to change security measures at any time without notice.

f) We are not responsible for any breach, loss, or compromise of your data regardless of cause.

6.3 Your Role in Security

You play an important role in keeping your information secure by:

a) Creating strong, unique passwords for your account

b) Not sharing your account credentials with others

c) Logging out of your account after using shared devices

d) Promptly reporting any suspicious activity or potential security breaches

8. DATA RETENTION

We retain your information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. When determining how long to retain information, we consider:

a) The amount, nature, and sensitivity of the information

b) The potential risk of harm from unauthorized use or disclosure

c) The purposes for which we process the information

d) Whether we can achieve those purposes through other means

e) Applicable legal requirements

9. YOUR RIGHTS AND CHOICES

Depending on your location, you may have certain rights regarding your personal information, which may include:

a) Access: Request access to the personal information we have about you.

b) Correction: Request that we correct inaccurate or incomplete information.

c) Deletion: Request deletion of your personal information in certain circumstances.

d) Restriction: Request restriction of processing of your personal information.

e) Data Portability: Request transfer of your personal information to you or a third party.

f) Objection: Object to our processing of your personal information.

g) Withdrawal of Consent: Withdraw consent previously provided.

To exercise these rights, please contact us using the information in the "Contact Us" section below.

10. CHILDREN'S PRIVACY

Our Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us, and we will take steps to delete such information.

11. INTERNATIONAL DATA TRANSFERS

Your information may be transferred to, and processed in, countries other than the country in which you reside. These countries may have data protection laws that are different from the laws of your country.

By using our Service, you consent to the transfer of your information to countries outside your country of residence, including the United States, where our primary servers and operations are located.

12. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time at our sole discretion and without notice. Any changes to this Privacy Policy are effective when they are posted on this page with an updated "Last Updated" date.

Your continued use of the Service after any modifications to the Privacy Policy, regardless of whether you have actually reviewed the modified Privacy Policy, will constitute your ACKNOWLEDGMENT, ACCEPTANCE, and AGREEMENT to be bound by the modified Privacy Policy. IT IS YOUR RESPONSIBILITY to check the Privacy Policy periodically for changes.

13. STARTUP DISCLAIMER - YOUR EXPLICIT ACCEPTANCE OF RISK

As a startup company, RDD Advisory LLC and the Boxi.ai Service are in active development. You EXPLICITLY ACKNOWLEDGE, UNDERSTAND, AND ACCEPT:

a) Our privacy infrastructure is rudimentary, unproven, under development and HAS SIGNIFICANT LIMITATIONS.

b) We WILL make substantial, unpredictable changes to our Privacy Policy and data practices as we grow, and you will have NO RIGHT to receive prior notification of such changes.

c) There are SEVERE AND SUBSTANTIAL risks in sharing ANY information (especially health-related or sensitive information) with any startup service or developing platform like ours.

d) We make NO COMMITMENT to any specific level of privacy protection beyond what is explicitly required by applicable law.

e) Our technology, systems, and practices are SIGNIFICANTLY LESS SECURE AND PROTECTIVE than those of established companies with mature privacy infrastructures.

f) We have LIMITED RESOURCES to respond to privacy incidents, data breaches, or security vulnerabilities.

g) YOU ASSUME ALL RISKS associated with providing your information to our Service.

h) We reserve the ABSOLUTE RIGHT to change how we collect, use, share, protect, or otherwise handle your information at any time and for any reason without notice.

14. FREEDOM TO OPERATE

Nothing in this Privacy Policy shall restrict our ability to use, analyze, aggregate, anonymize, or otherwise process any information we collect through the Service for any lawful business purpose, including to improve our services, develop new features or services, conduct research, or for any other purpose we deem appropriate in our sole discretion.

15. NO LIABILITY FOR THIRD-PARTY ACTIONS

We are not responsible for any use, misuse, or disclosure of your information by third parties, whether such disclosure was authorized or not. You agree to hold us harmless from any damages that may result from any use, misuse, or disclosure of your information by third parties.

16. CONTACT US

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Boxi.ai
contact@boxi.ai

For privacy concerns related to health information shared through our Service, please specify this in your communication.