Privacy Policy

Ravel Technological Solutions LTD. ("Ravel", "Twofold", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use and share information through our website at https://www.trytwofold.com (the "Website"), our software-as-a-service platform (the "Platform"), and our mobile application.

Patient information is not covered by this policy

Clinical information about patients, including recordings, transcripts and notes, is governed by our Business Associate Agreement (BAA) with the practice or clinician, not by this Privacy Policy. For that information we act as a business associate under HIPAA, and the practice is the covered entity. We use it only as the BAA permits: to provide the service, to review the quality of the documentation we generate, and to run our business. We do not use it for marketing or advertising, do not share it with advertisers or analytics providers, and do not use it to train or fine-tune machine learning models. Nothing from one customer's data is used to improve the service for another. Twofold does adapt to your documentation style, but not by training anything: it applies your own templates, settings and previous notes as context when it drafts a new note for you. No model is trained or fine-tuned on your data, and nothing you enter changes the service for anyone else. Where this Privacy Policy and the BAA differ, the BAA controls.

Who this policy applies to

People who visit the Website ("Visitors"), those who register to use the Platform ("Customers"), and those a Customer authorises to use it, such as employees and contractors ("Authorized Users").

Information we collect

• Contact information you give us: your email address, and optionally your name, practice name and role. We do not ask for your phone number.

• Account information needed to sign in and manage your account.

• Usage information about how the Website and Platform are used, collected through cookies and similar technologies.

• Clinical information you enter or record in the Platform. We process it only to produce your documentation and return it to you. We do not use it for our own purposes, and it is handled under the BAA as described above.

How we use it

To provide, secure and improve the Website and Platform; to respond to you; to send service messages; for marketing, using contact and usage information only, never clinical information; and to meet our legal obligations.

Who we share it with

We use service providers to run Twofold. The only ones that process clinical information are Microsoft Azure, Google Cloud and Google Workspace, each covered by a Business Associate Agreement.

Other providers support sign-in, product analytics, error reporting, system logs, customer support, email, billing and marketing measurement. They are configured so that they do not receive clinical information. A current list is available on request.

We also share information where the law requires it, and in connection with a merger or acquisition.

Your choices

• Update your information in your account, or by contacting us.

• Marketing email: unsubscribe using the link in any marketing message.

• Cookies: manage them in your browser. Disabling them may affect how the Website and Platform work.

Retention and deletion

We keep Customer accounts and their clinical information for as long as the Customer uses Twofold. After a Customer leaves, we continue to hold their information, under the protections of the BAA, until they ask us to return or destroy it, which we do within 30 days of the request. A practice may also ask us to delete the stored copies relating to particular patients. Contact information is kept until you ask us to remove it.

Security

We maintain administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption, access controls and a documented security program. No method of transmission or storage is completely secure.

Children

The Platform is used by clinicians, and we do not knowingly collect information directly from children. Clinicians may document care for patients of any age, including minors; that information is clinical information, handled under the BAA and at the direction of the practice.

Where we operate

Our systems process and store information in the United States. Twofold is an Israeli company, and members of our team outside the United States may access non-clinical information, such as account and support data, in the course of their work. Access to clinical information is limited to the staff who need it.

How to reach us, and how to complain

Ravel Technological Solutions LTD., 4 Gordon St, Rehovot 7629112, Israel. Registration no. 516895075.

Questions, requests about your information, or a complaint about how we have handled it: info@trytwofold.tech. We aim to respond promptly. If you are not satisfied, you may complain to the data protection authority in your country, named in the section for your jurisdiction below.

Brazil

Where the Lei Geral de Proteção de Dados (Lei 13.709/2018) applies:

• Our role. For clinical information we are the operador, and the clinician or clinic is the controlador. For your account, billing and contact data we are the controlador.

• Legal bases. The basis for processing clinical information is held by the treating professional under art. 11, II (d), _tutela da saúde_. For your account data we rely on performance of our contract with you, our legitimate interests in operating and securing the service, and compliance with legal obligations.

• Your rights. Under art. 18 you may ask for confirmation of processing, access, correction, anonymisation, blocking or deletion, portability, information about with whom we have shared your data, and you may withdraw consent where consent is the basis. Requests about a _patient's_ records go to the practice that treats them; we direct anyone who asks us and tell the practice.

• Encarregado. Reachable at privacidade@trytwofold.com. Atendimento em português. The encarregado's name is given on request.

• International transfer. Clinical information is processed in the United States by Microsoft Azure, Google Cloud and Google Workspace. The transfer is made under the standard contractual clauses approved by Resolução CD/ANPD nº 19/2024, adopted without alteration and annexed to our LGPD addendum. Under Cláusula 14 of those clauses the practice, as controlador, is the party that publishes the transparency document for its own patients; we publish this information to support that and to inform our own users.

• Authority. You may complain to the Autoridade Nacional de Proteção de Dados (ANPD).

Australia

Where the Privacy Act 1988 (Cth) applies, we are an APP entity and the Australian Privacy Principles bind us directly:

• Overseas disclosure. We are likely to disclose personal information, including health information, to recipients located in the United States.

• Sensitive information. Health information is sensitive information. It is collected by your clinician with your consent, and we receive it to provide the documentation service.

• Access and correction. Ask us at the address above. Requests about a patient's clinical record go to the treating clinician.

• Data breaches. Where an eligible data breach occurs, we notify the Office of the Australian Information Commissioner and, where Part IIIC requires it of us, the affected individuals.

• Authority. You may complain to the Office of the Australian Information Commissioner (OAIC).

Canada

Where PIPEDA or provincial health privacy legislation applies:

• Our role. For health information we act as the custodian's information manager, electronic service provider or service provider, depending on the province, and we use it only as necessary to provide the service. The custodian remains accountable to the patient.

• Accountability. Our Security Official is the designated individual accountable for our compliance, reachable at the address above.

• Location. Information is processed in the United States. Where a provincial law requires your custodian to assess that transfer, we provide the material for it.

• Breaches. We notify the custodian at the first reasonable opportunity, and report to the Office of the Privacy Commissioner of Canada where a breach of data we hold in our own right poses a real risk of significant harm.

• Authority. You may complain to the Office of the Privacy Commissioner of Canada, or to your provincial commissioner.

Other websites

The Website and Platform may link to sites we do not control. Their privacy practices are their own.

Changes

We may update this policy. Continued use of the Website or Platform after a change means you accept the updated policy.

Questions about this policy: info@trytwofold.tech