This Privacy Policy explains how BlackBag, LLC (“BlackBag,” “we,” “us,” or “our”) collects, uses, shares, and protects information when you use our websites, patient and clinician applications, and related services (together, the “Services”).
It applies to patients, clinicians, practice users, and website visitors. It is a privacy notice, not a substitute for a clinician’s Notice of Privacy Practices or any consent required for medical treatment or consultation recording.
The short version
Your information supports your care - not advertising.
- We use health information to provide and support the Services.
- We do not sell personal information or protected health information.
- Payment providers process payment details on our behalf.
- Where enabled and disclosed, consultations may be recorded or transcribed to prepare clinical documentation.
1. Scope and healthcare roles
BlackBag provides technology that helps patients and clinicians prepare for, schedule, conduct, document, and pay for specialist consultations. Clinicians using BlackBag are responsible for the care they provide and may be separate healthcare providers or covered entities under applicable law.
A clinician may maintain a legal medical record about you. That clinician’s privacy notice and professional record-retention duties may apply in addition to this policy. When BlackBag handles protected health information on behalf of a covered healthcare provider, we do so under applicable law and contractual requirements, including a Business Associate Agreement where required.
2. Information we collect
Account and contact information
Name, email address, telephone number, mailing or billing address, account credentials, communication preferences, and other information used to create, verify, or support your account.
Patient and health information
Health concerns, medical history, conditions, medications, allergies, reports, laboratory results, imaging, uploaded records, appointment details, messages, clinical notes, and other information you or your clinician add to the Services.
Consultation information
Video-session details and, where the feature is enabled and appropriate notice or consent has been provided, consultation audio, recordings, transcripts, summaries, and draft clinical documentation.
Clinician and practice information
Professional contact details, credentials, licenses, specialties, areas of experience, profile information, availability, consultation fees, practice affiliations, verification information, and payout details.
Payment and transaction information
Payment method type, payment tokens, limited card details such as brand and last four digits, billing status, receipts, refunds, clinician earnings, and payout status. Full payment credentials are generally collected and processed by payment providers rather than stored directly by BlackBag.
Communications and support
Messages between users, support requests, feedback, and records of communications with us.
Device and usage information
IP address, browser and device type, operating system, identifiers, sign-in and access times, pages or features used, crash information, and security or audit events.
3. Where information comes from
We may receive information:
- Directly from you when you create an account, book a visit, complete a profile, upload a record, or contact us.
- From a patient, clinician, or authorized practice user involved in your care or account.
- From professional registries or verification services used to review clinician credentials.
- From payment, communications, video, document-processing, and other service providers.
- Automatically when you use the Services.
4. How we use information
We use information to:
- Create, verify, secure, and administer accounts and clinician profiles.
- Help patients find clinicians and schedule consultations.
- Support video visits, messaging, records, and clinical documentation.
- Process patient charges, receipts, clinician earnings, and payouts.
- Send appointment, account, security, payment, and service communications.
- Provide support, investigate problems, prevent misuse, and maintain audit records.
- Improve accessibility, reliability, performance, and user experience.
- Comply with legal, regulatory, contractual, and professional obligations.
- Create aggregated or de-identified information that does not reasonably identify an individual.
5. Consultations, transcripts, and AI-assisted documentation
When enabled, BlackBag may use audio and other information from a consultation to produce a transcript, summary, or draft clinical note. Recording and transcription will be subject to the notices and consents required for that consultation.
Automated outputs can contain errors or omit important context. They are drafts for an authorized clinician to review, edit, and approve. They do not replace the clinician’s judgment and should not be treated as final medical advice on their own.
8. Security
We use administrative, technical, and physical safeguards designed to protect information. These may include encryption, access controls, authentication, private storage, audit logging, monitoring, and recovery procedures. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.
Keep your credentials private, use a secure device and network, and contact us promptly if you believe your account has been accessed without permission.
9. Retention
We retain information for as long as needed to provide the Services and meet legal, clinical, payment, security, dispute-resolution, and contractual obligations. Retention periods vary by the kind of information and the role in which BlackBag holds it.
Closing an account does not necessarily delete information that a clinician must keep as part of a medical record or that BlackBag must retain for legal, billing, fraud-prevention, or audit purposes. When information is no longer required, we delete it, de-identify it, or securely isolate it as appropriate.
10. Your choices and rights
Depending on applicable law and our role, you may be able to:
- Access, correct, or update account information.
- Request a copy of certain information.
- Request deletion or restriction where legally available.
- Withdraw an optional consent for future processing.
- Opt out of promotional email while continuing to receive service messages.
- Complain to an appropriate regulator or data-protection authority.
Some medical-record requests must be directed to the clinician or practice that controls the record. We will help route or support a request where appropriate. To make a privacy request, email support@myblackbag.com. We may need to verify your identity before completing it.
11. HIPAA and other health-privacy laws
HIPAA applies only in particular circumstances and to particular organizations and information. Where BlackBag is a business associate to a covered healthcare provider, protected health information is handled according to HIPAA and the applicable Business Associate Agreement. A Business Associate Agreement is available to eligible covered entities where required.
Other health information may be governed by federal or state consumer-health, privacy, and breach-notification laws. BlackBag will provide legally required notices if a reportable breach affects your information.
12. Children and minors
BlackBag accounts are intended for adults. A parent or legal guardian may provide information about a minor only where the Services expressly allow it and the adult has the authority and any consent required to do so. If you believe information about a child was collected improperly, contact us.
13. Changes to this policy
We may update this policy as the Services or applicable requirements change. We will update the date above and provide additional notice when a material change requires it.
14. Contact us
For privacy questions or requests, contact the BlackBag Privacy Team at legal@myblackbag.com or support@myblackbag.com.
Questions about these Services may also be governed by our Terms and Conditions.