Privacy Policy

Last Updated: May 1, 2026

At Pazific Technologies LLC, doing business as BellaVita AI ("the Company," "we," "us," or "our"), we are deeply committed to protecting the privacy and security of your information and the sensitive data entrusted to us. This Privacy Policy describes how we collect, use, maintain, and disclose information when you visit our website located at bellavitaai.com (the "Website") and utilize our proprietary web-based platform (the "Platform" or "Service").

By accessing or using our Website and Platform, you acknowledge that you have read, understood, and agree to be bound by the terms of this Privacy Policy. If you do not agree with our policies and practices, your choice is not to use our Website or Platform.

1. Description of Users and Acceptance of Terms

This Privacy Policy applies to different categories of individuals interacting with our offerings:

Visitors: Individuals who browse our Website without signing up for or using the Platform.
Customers (or "Users"): Individuals, typically clinicians or health-professionals, who have registered an account to access and use our Platform. When we refer to "you" in the context of using the Platform, we are primarily referring to Customers.
Patients/Clients: Individuals whose information is entered into the Platform by a Customer for the purpose of generating clinical notes and reports.

By using our Website, Visitors agree to the terms outlined in this Privacy Policy and our Website Terms of Use.

Customers, by accessing and using the Platform, signify their agreement to this Privacy Policy and the accompanying Platform Terms of Service.

Any capitalized terms not explicitly defined within this Privacy Policy will have the meanings ascribed to them in our Website Terms of Use or Platform Terms of Service, as applicable.

2. Information We Collect

We collect various types of information to provide and enhance our Services.

2.1 Information You Provide Directly

Customer Account and Profile Information: When you register for an account on our Platform, we collect your email address and enable you to create a password. We also collect profile information you choose to provide, such as your first name, last name, phone number, address, professional specialty, title, and practice name. This information is necessary to properly attribute and complete clinical documentation generated by the Service and for essential communication. While providing some profile details is optional, omitting them may result in incomplete reports. You can update your profile information at any time within your account settings on the Platform.
Patient/Client Information: As a Customer, when you add a new patient or client to the Platform, you are required to provide their name or full name. You may optionally provide additional details such as date of birth, age, email, and phone number. You retain control over whether to input these optional details.
Input Data for Services: This includes audio recordings of patient/client visits or sessions and the subsequent transcriptions and generated notes/reports. This data may contain sensitive health information. Audio recordings are automatically deleted once its transcription is completed.
Communications and Support: If you contact us for support, inquiries, or provide feedback, we collect the content of your communication and any associated contact details.

2.2 Information Collected Automatically

As you navigate and interact with our Website and Platform, we may use automated data collection technologies to gather certain information:

Usage and Device Information: We may collect details about your access to and use of the Services, including traffic data, usage patterns (e.g., features used, frequency and duration of use), IP address, browser type, operating system, and other technical information about the device you use to access our Services. This information is collected for the sole purpose of improving our service.
Cookies and Other Tracking Technologies: We may utilize cookies (small data files placed on your device's hard drive) and similar technologies (such as web beacons, pixels) to automatically collect or receive information. These technologies help us to:
- Maintain the security and operation of our Services.
- Analyze how users interact with our Services to identify opportunities for improvement and optimize functionality.
- Enhance and personalize your experience.
- Understand the effectiveness of our Website and Platform.
- Troubleshoot technical issues.
  
  You can configure your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. However, please note that disabling cookies may limit the functionality of certain parts of our Website and Platform.

3. How We Use Your Information

We use the information we collect for the following primary purposes:

Service Provision and Operations: To operate, maintain, and provide the core functionalities of the Website and Platform, including enabling Customer access, processing audio recordings, generating transcriptions, and creating AI-powered notes and reports.
Account Management: To manage your Customer account, authenticate your identity, and facilitate secure access to the Platform.
Service Improvement: To analyze usage trends, conduct internal analytics, and gather insights to continuously improve the performance, features, and overall user experience of our Website and Platform. Your personal data, and any data derived from your interactions or input, including any de-identified data, is not used for the purpose of AI model training, tuning, or improvement.
Communication: To communicate with you regarding your account, important service updates, technical support, security alerts, and other essential notices.
Security and Compliance: To detect, prevent, and investigate fraudulent, unauthorized, or illegal activities, enforce our terms and policies, and comply with applicable legal and regulatory requirements.

4. How We Share Your Information

We are committed to maintaining the confidentiality and privacy of your information.

No Sale or Marketing Sharing: We do not sell, rent, or share your personal data or your patients'/clients' personal data with any third party for their direct marketing, advertising, or commercial purposes.
Service Providers: We may share information with trusted third-party contractors and service providers who perform functions on our behalf to operate and improve our business and Services. These include providers for cloud hosting, data processing, security, analytics, and other operational support. All such providers are contractually obligated to protect your information, use it solely for the purposes for which we disclose it to them, and adhere to strict confidentiality and security standards. All cloud providers we utilize are HIPAA compliant and maintain their own robust privacy and security policies to safeguard data during processing and storage. Where such service providers have access to Protected Health Information (PHI), we ensure they are contractually bound by a Business Associate Agreement (BAA) that provides at least the same level of protection for PHI as set forth in our BAA with you.
Legal Compliance and Protection: We may disclose your information if required by law, regulation, court order, subpoena, or other legal process, or when we believe in good faith that disclosure is necessary to protect our rights, property, or safety, or the rights, property, or safety of our Customers, patients/clients, or the public, or to investigate fraud or respond to a governmental request.
Business Transfers: In the event of a merger, acquisition, reorganization, dissolution, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email to the primary email address specified in your account and/or a prominent notice on our Website of any such change in ownership or control of your personal information.

5. Data Handling

Our Platform employs specific mechanisms to protect sensitive data:

Audio Recording Deletion: Audio recordings of patient/client visits or sessions are used to create transcriptions. Once the transcription is successfully generated and available, the original audio recording is automatically and immediately deleted from our systems.
Transcription Data: Transcripts generated by the Service are treated as Protected Health Information (PHI) and are stored using industry-standard encryption. While the Service may utilize natural language processing to identify and categorize clinical roles (e.g., "Clinician," "Patient") for the purpose of generating structured notes, the underlying transcript remains a secure part of the patient record. We do not use transcription data for the purpose of AI model training.

6. HIPAA Compliance

We are dedicated to protecting Protected Health Information (PHI) in accordance with the Health Insurance Portability and Accountability Act (HIPAA) and its implementing regulations. Our Platform and the underlying cloud infrastructure are designed and maintained with HIPAA compliance as a fundamental principle, incorporating appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of PHI.

7. Data Security

We implement commercially reasonable security measures and a comprehensive suite of safeguards designed to protect your personal information and your patients'/clients' data from unauthorized access, use, alteration, and disclosure. Our commitment to data security includes:

Encryption: All data is encrypted both in transit (using industry-standard protocols such as TLS/SSL) and at rest (using strong encryption protocols like AES-256 or similar, for data stored on our servers).
Access Controls: We employ stringent access controls, including multi-factor authentication, strong password policies, and role-based access restrictions, to limit access to systems containing sensitive data only to authorized personnel.
Strict Internal Access and Confidentiality: We maintain a strict "need-to-know" policy for employee access to data. Our personnel are trained on data privacy and security protocols. We prohibit unauthorized employee access to your personal data or your patients'/clients' data. Any access for customer support, troubleshooting, or operational purposes is strictly limited, performed only with your explicit consent (where applicable and feasible), and conducted under secure, monitored, and auditable conditions.
Continuous Security Vigilance: We maintain ongoing oversight of our systems through regular security monitoring, vulnerability assessments, and proactive penetration testing to detect and mitigate potential security weaknesses.
Security Incident Management: Our established protocols ensure the prompt identification, thorough response, and effective management of any suspected or actual security incidents, including measures for containment, mitigation of harm, and appropriate notifications. In the event of a suspected security breach involving your account or PHI, you are required to notify us within twenty-four (24) hours of discovery to facilitate our mutual compliance with HIPAA Breach Notification Rules.

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee its absolute security. The safety and security of your information also depend on you. Where we have provided you with (or where you have chosen) a password for access to certain parts of our Platform, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

8. Data Retention and Deletion

We retain different types of information for varying periods:

Session Recording Deletion: While session recordings are typically deleted immediately upon successful transcription as described in Section 5, in the event of a technical failure in the transcription process, all Session Recordings are subject to a mandatory "fail-safe" deletion within seven (7) days of upload, regardless of processing status.
Customer Account Data: We retain your Customer account and profile information for as long as your account remains active or as necessary to provide you with our Services, comply with our legal obligations, resolve disputes, and enforce our agreements.
Patient/Client Data: As a Customer, you have control over the retention of patient/client notes, transcripts and reports data within the Platform. You can configure this data to be:
- Retained for the entire duration your account remains active.
- Manually deleted by you at any time.
- Automatically deleted after a pre-defined period, based on your configured settings.
Important Note Regarding PHI Retention: Notwithstanding the flexible retention options provided within our Platform, please be advised that our application is designed as a tool for the generation and temporary management of clinical documentation, and is explicitly not intended to serve as a permanent archive or Electronic Health Record (EHR)/Electronic Medical Record (EMR) system for Protected Health Information (PHI). It remains the Customer's sole responsibility to ensure the timely and secure transfer of any necessary PHI from the Platform to appropriate, long-term record-keeping systems (such as your designated EHR/EMR) to comply with your professional, legal, and regulatory obligations for patient record retention.
Legal Obligation: We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.
Your Right to Deletion: We will comply with any applicable legal requirements regarding the deletion of your personal data. You may delete your account and associated data by canceling your service directly through the platform settings. Alternatively, or for specific data deletion requests or assistance, you may also contact us using the information provided in Section 13.

9. Children's Privacy

Our Website and Platform are not intended for direct use by anyone under the age of 18. We do not knowingly collect personal information directly from individuals under 18. If you are a Customer using our Service to process information pertaining to a minor patient or client, you represent and warrant that you have obtained all necessary parental or legal guardian consents and approvals required by applicable laws and ethical guidelines to input and process such information within the Platform. If we become aware that personal information has been collected directly from a child under 18 without appropriate consent, we will take steps to remove that information from our servers.

10. External Links

Our Website and Platform may contain links to external third-party websites for informational or tutorial purposes. Please be aware that we have no control over the privacy practices or the content of these external sites. As such, we are not responsible for the content or privacy policies of those external sites. We encourage you to review the applicable privacy policy and terms of use when visiting any third-party websites.

11. International Data Transfer (United States Only)

Our Website, Platform, and their supporting servers are operated in the United States. If you are accessing our Services from outside the United States, please be aware that any information you provide to us may be transferred to, processed, maintained, and used on computers, servers, and systems located within the United States, where data protection laws may differ from those in your jurisdiction. By using our Services, you consent to any such transfer and processing of your information in accordance with this Privacy Policy. We currently do not intend for our Services to be used outside the United States. Should this change, this Privacy Policy will be updated, and current and new users will be notified.

12. Your Privacy Choices

We strive to provide you with choices regarding the personal information you provide to us.

Cookies: Most browsers allow you to manage or refuse cookies. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of the Website and Platform may be inaccessible or may not function properly.
Marketing Communications: You may manage your receipt of marketing communications from us by clicking on the "unsubscribe" link located at the bottom of any of our marketing emails. Please note that you cannot opt out of receiving essential transactional emails related to your account or Service updates.
Google Analytics Opt-Out: You can opt out of Google Analytics data collection by installing the Google Analytics opt-out browser add-on, available here.

13. Changes to This Privacy Policy

This Privacy Policy is effective as of the date stated at the top of this document. We reserve the right to update or modify this Privacy Policy from time to time. We will notify you of any material changes by posting the revised Privacy Policy on this page, updating the "Effective Date," and, where appropriate, by sending a notice to the primary email address specified in your account or through a prominent notice on the Website or Platform. Your continued use of the Website and/or Platform after we post any modifications to this Privacy Policy will constitute your acceptance of those changes. We encourage you to review this Privacy Policy periodically for updates.

14. State-specific privacy rights

14.1 General State Rights. Residents of certain states, including Florida (under the Florida Digital Bill of Rights), Colorado, Connecticut, Utah, and Virginia, may have additional rights regarding their personal information. These rights may include the right to know, delete, or correct personal data, and the right to opt-out of the sale of personal information.

14.2 Notice to California Residents. Pursuant to the California Consumer Privacy Act (CCPA), California residents have certain rights regarding their personal information. These rights may include the right to request access to specific pieces and categories of personal information we have collected about them, the right to request deletion of personal information, and the right to opt-out of the sale of personal information.

No Sale of Personal Information: We do not sell your personal information as defined under the CCPA.
Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
Shine the Light: California Civil Code Section 1798.83 permits users of our Website and Platform who are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please contact us using the information in Section 13.

14.3 Notice to Nevada Residents. If you are a resident of Nevada, you have the right to opt-out of the sale of certain personal information to third parties. We do not currently sell your personal information as defined by Nevada Revised Statutes Chapter 603A. If you have any privacy concerns, you may contact us using the information in Section 13.

15. Notices

All formal notices to the Company must be sent to the email address listed in the "Contact Information" section. To be effective, any notice sent via physical mail must also be sent via email on the same day. Notices shall be deemed received: (i) one (1) business day after email transmission; or (ii) five (5) business days after being deposited in the U.S. Mail (Certified, Return Receipt Requested), provided that the sender can produce a corresponding email delivery receipt.

16. Contact Information

If you have any questions or concerns regarding the Service or these legal documents (including the Website Terms of Use, Terms of Service, Privacy Policy, or Business Associate Agreement), please contact the Company. For the fastest response, please contact us via email. All formal notices or inquiries should be directed to:

Email: legal@bellavitaai.com

Attn: Privacy & Compliance Officer

Entity: Pazific Technologies LLC d/b/a BellaVita AI

Mailing Address: 7901 4th St N STE 300, St. Petersburg, FL 33702