Privacy Policy
Effective date: October 4, 2026
1. Who we are
Root Health is a concierge functional-medicine membership practice serving patients located in Washington State. Two companies work together under the Root Health name:
- Root Health Medical PLLC (the "Practice") is a Washington professional limited liability company. It provides all clinical care, employs or contracts with the licensed clinicians, and is the HIPAA "covered entity" for your medical information.
- Root Health LLC (the "Manager") is a Washington limited liability company. It operates the website at https://roothealth.care and the patient portal, and provides billing, technology, and administrative services to the Practice. When it handles your medical information, it acts as the Practice's HIPAA "business associate" under a written agreement.
In this policy, "Root Health," "we," and "us" mean both companies. Our mailing address is 12224 NE Bel-Red Rd #729, Bellevue, WA 98005.
2. What this policy covers, and what the Notice of Privacy Practices covers
Your information falls into two groups, and different rules apply to each.
Protected health information (PHI). Once you become a patient, the health information the Practice creates or receives about you is PHI under the federal HIPAA Privacy Rule. This includes your intake answers, visit notes, transcripts, lab orders and results, treatment plans, messages with the care team, and billing records tied to your care. How we use and share PHI, and your rights over it, are set out in our Notice of Privacy Practices (NPP). You acknowledge the NPP during signup, and you can read it at any time in the portal or ask us for a paper copy. If this policy and the NPP conflict on anything involving PHI, the NPP controls.
Everything else. This policy covers information that is not PHI, such as what you share when browsing the website, joining our waitlist, contacting us before you become a patient, or starting signup, plus technical data from your device. Some of that information may be "consumer health data" under the Washington My Health My Data Act (RCW 19.373). Section 11 is our Consumer Health Data Privacy Policy under that law.
3. Information we collect
| Category | Examples | Source |
|---|---|---|
| Contact and account information | Name, email address, phone number, date of birth, mailing address, emergency contact. You sign in with a one-time link or code sent to your email. If your account has a password, we store it only as a hash. | You |
| Waitlist sign-ups | Name, email address, and an optional phone number | You |
| Membership and payment information | Plan selected, billing cycle, founding-member status, referral code, payment history. Card numbers go directly to Stripe; we store only the card brand, last four digits, and expiration. | You and Stripe |
| Health information | Symptoms, health history, intake answers, medications and supplements, lab results you upload, visit transcripts and notes, treatment plans, messages with the care team | You, your clinician, labs you use through us |
| Visit audio | Audio of video and in-home visits, captured only with your consent for AI-assisted note taking. We do not record video. | Your visit |
| Communications | Messages, feedback you submit in the portal, emails and texts you send us | You |
| Information about other people | The name and email of a friend you refer, or of family members you enroll | You |
| Device and technical data | IP address, browser and device type, pages requested, time of request, error reports | Your browser, automatically |
| Preferences stored on your device | Accessibility settings (text size, reduced motion, high contrast), time zone, dismissed notices | Your browser's local storage |
We do not buy information about you from data brokers.
4. How we use information
- To create and secure your account, verify your email, and sign you in.
- To enroll you in a membership, process payments, issue superbills, and apply referral credits.
- To provide care: scheduling, video and in-home visits, messaging, lab ordering, treatment plans, and supplement recommendations.
- To send appointment reminders, billing notices, and account alerts by email, text, push notification, or in the portal. Email, text, and push messages never contain clinical details. They tell you new information is available and link you to the portal.
- To tell waitlist sign-ups when membership opens.
- To keep the service running and secure: debugging, fraud prevention, and audit logging of who accessed which record.
- To comply with law, respond to lawful requests, and enforce our Terms of Service.
We do not sell personal information or consumer health data. We do not use your information for targeted advertising, and we do not run advertising pixels or third-party analytics on the website or portal.
5. How we use artificial intelligence
We use AI tools to reduce paperwork so your clinician can focus on you. Here is what happens:
- Visit transcription. If you have given AI scribe consent, audio from your visit is sent to Deepgram, a speech-to-text service, which returns a written transcript with speaker labels. Video is never recorded.
- Draft notes. The transcript is sent to Claude, an AI model made by Anthropic, which drafts a clinical note in the standard SOAP format.
- Clinician review. Your clinician reads, edits, and approves every AI draft before it becomes part of your medical record. Nothing an AI writes enters your record without that review.
- Lab documents. When you or the care team upload a lab report PDF, Claude reads it and pulls the values into structured form so they can be charted over time. The care team checks the extracted values.
- Summaries and messages. We may use AI to prepare plain-language summaries of lab results and treatment plans, and to send an automatic acknowledgment when you message us after hours. An automatic acknowledgment is not medical advice. A member of the care team follows up.
How we reach Claude. Today we send this information to Claude through Anthropic's own API. Before we open membership to the public, we will move this processing to Claude on Amazon Bedrock, which runs inside Amazon Web Services under our business associate agreement with AWS. We will update this policy when that move is complete.
No model training. Deepgram and Anthropic do not use the audio, transcripts, or other information we send them to train their AI models. We opt out of Deepgram's model-improvement program on every request, and Anthropic's commercial terms do not allow it to train models on the data we send.
You can decline AI scribe for any visit by telling your clinician at the start, or withdraw your consent entirely in writing. Your clinician will then take notes by hand, and your care is not affected.
6. Cookies and similar technologies
We use a small number of cookies and browser storage items, all required for the site to work or to remember choices you made:
- Sign-in cookies set by our authentication provider, Supabase, keep you signed in and let our server confirm who you are on each request.
- Local storage on your device keeps your accessibility settings, time zone, and which notices you have dismissed. This data stays on your device and is not sent to us.
- Bot protection. Public forms such as the waitlist use Cloudflare Turnstile, which checks your browser for signs of automated abuse.
- Payment pages hosted by Stripe may set Stripe's own cookies for fraud prevention.
We do not use advertising cookies, cross-site tracking, or third-party analytics. Because we do not track you across sites, we treat browser "Do Not Track" and Global Privacy Control signals as already satisfied. If we ever add analytics, we will update this policy first and will not place it on pages inside the patient portal.
7. Who we share information with
We share information only as described here and in the NPP.
Service providers. These companies process information on our behalf under written contracts. Before we open membership to the public, each provider that handles PHI will have signed a HIPAA business associate agreement with us.
| Provider | Purpose |
|---|---|
| Supabase | Database, sign-in, and file storage |
| Railway | Application hosting and background job processing |
| Stripe | Payment processing |
| Daily.co | Video visits |
| Deepgram | Speech-to-text transcription of visit audio |
| Anthropic (Claude), through Anthropic's API today and Amazon Bedrock before public enrollment | Drafting visit notes, reading lab documents, plain-language summaries |
| Amazon Web Services (Simple Email Service) | Sending sign-in emails |
| Cloudflare | Sending account and appointment emails; bot protection on public forms |
| Twilio | Sending text messages |
| Stream | Secure messaging with the care team |
| Rupa Health | Lab test ordering, when your labs are ordered through it |
| Fullscript | Supplement dispensary, when you order supplements through it |
| Sentry | Error monitoring for the website and portal |
Labs, pharmacies, and other clinicians involved in your care, as described in the NPP.
Legal and safety reasons. When required by law, subpoena, or court order; to protect someone's health or safety; or to investigate fraud or abuse.
Business transfers. If Root Health is sold or merged, information may transfer to the new owner, who must honor this policy and the NPP.
With your permission. For anything else, we ask first.
8. How long we keep information
| Information | How long |
|---|---|
| Medical records | As long as Washington medical-record retention law requires, and at least 10 years after your last visit for adults. For minors, at least 3 years after the patient turns 18 or 10 years after the last visit, whichever is longer. |
| Visit audio | Deleted once your clinician approves the visit note |
| Billing and payment records | 7 years, for tax and accounting |
| Account information that is not part of the medical record | Life of the account, then deleted within 90 days of closing it, unless the law requires us to keep it |
| Server logs and error reports | 90 days |
| Inquiries and waitlist sign-ups from people who do not become patients | 12 months |
When a retention period ends, we delete or de-identify the information.
9. How we protect information
- Data is encrypted in transit (TLS) and at rest (AES-256).
- Access is role-based. Staff see only what their role requires, staff accounts use multi-factor authentication, and access to patient records is logged.
- We track the status of each service provider's business associate agreement in a registry.
- Email and text messages never carry clinical content.
No system is perfectly secure. If a breach affects your information, we will notify you as required by HIPAA and Washington law (RCW 19.255.010).
10. Your choices and rights
- Your medical record. Your rights to access, copy, amend, restrict, and receive an accounting of disclosures of your PHI are in the NPP. You can download your records from the portal under Settings.
- Account information. You can update your contact details in the portal at any time.
- Communications. You can change notification preferences in the portal. Reply STOP to any text to stop texts. Some account and billing notices cannot be turned off while you are a member.
- AI scribe. You can decline it for any visit or withdraw consent entirely (Section 5).
- Consumer health data rights. See Section 11.
11. Washington Consumer Health Data Privacy Policy
This section is our Consumer Health Data Privacy Policy under the Washington My Health My Data Act, RCW 19.373. It applies to "consumer health data," meaning personal information that identifies or can be linked to you and relates to your past, present, or future physical or mental health. It does not apply to PHI governed by HIPAA, which the NPP covers.
Consumer health data we collect. Information that shows you are seeking health care (for example, that you joined our waitlist, started signup for a functional-medicine membership, or chose a plan); health details you share in an inquiry, feedback, or support message before you become a patient; and health information about someone you refer or enroll.
Why we collect and use it. To respond to your inquiry, complete your enrollment, provide the membership you requested, keep the service secure, and comply with law. We collect and use consumer health data only as necessary to provide the service you asked for, or with your consent.
Sources. You, and people who refer or enroll you.
Consumer health data we share, and with whom. We share it only with the service providers in Section 7 that need it to deliver the service (in practice Supabase, Railway, Stripe, Amazon Web Services, Cloudflare, and Twilio, for signup and account messages), and between Root Health Medical PLLC and Root Health LLC, which are affiliates that operate the practice together. We share consumer health data for any other purpose only with your separate consent. We do not sell consumer health data.
No geofencing. We do not use geofences around health-care facilities to collect data or send messages.
Your rights. You have the right to:
- Confirm whether we collect, share, or sell your consumer health data, and access it, including a list of every third party and affiliate we have shared it with and how to contact them.
- Withdraw consent to our collection and sharing of your consumer health data.
- Have your consumer health data deleted. We will also tell our service providers and affiliates to delete it. Copies in backup systems are deleted when the backup is restored, and no later than six months after your request.
How to make a request. Email privacy@roothealth.care or write to us at 12224 NE Bel-Red Rd #729, Bellevue, WA 98005. We will verify your identity using information on file before acting. We respond within 45 days. If we need more time, we will tell you why, and we may extend once by another 45 days. You may make two requests in any 12-month period at no charge.
Appeals. If we deny your request, you can appeal by replying to our decision or emailing privacy@roothealth.care with "Appeal" in the subject line. We will answer within 45 days and explain our reasoning. If we deny your appeal, you can file a complaint with the Washington State Attorney General at https://www.atg.wa.gov/file-complaint.
Nondiscrimination. We will not treat you differently for exercising these rights.
12. Children
The website and portal are not directed to children under 13, and only adults may create accounts. When family memberships become available, a parent or legal guardian enrolls and manages a minor's care. Teens have certain confidentiality rights under Washington law, described in the NPP. If you believe a child has given us information without a parent's consent, email us at privacy@roothealth.care.
13. Changes to this policy
We will post any change here with a new effective date. If a change materially affects how we use information we already hold, we will notify members by email or in the portal before it takes effect, and we will ask for consent where the law requires it.
14. Contact us
- Privacy Officer: Ben Sharpe
- Email: privacy@roothealth.care
- Portal: members can send a secure message to the care team at any time
- Mail: Root Health Medical PLLC, Attn: Privacy Officer, 12224 NE Bel-Red Rd #729, Bellevue, WA 98005
You may also file a complaint about the handling of your PHI with the U.S. Department of Health and Human Services, Office for Civil Rights, at https://www.hhs.gov/ocr/complaints. We will not retaliate against you for filing a complaint.