Privacy Policy
Effective October 1, 2026
Lucy is software provided by Tek Hubs LLC ("Tek Hubs", "we", "us") to healthcare practices ("Clinics"). This policy explains what we collect about the people who use Lucy, and how we handle the Clinic data Lucy holds, including patients' protected health information.
Two kinds of information
- Information about you as a user: who you are and what you do in Lucy. The rest of this policy is mostly about this.
- Clinic data: patients, insurance, benefits, claims, payments and faxes. This includes protected health information ("PHI") under the Health Insurance Portability and Accountability Act ("HIPAA"). We handle it on behalf of the Clinic, as its business associate, under its Business Associate Agreement and HIPAA, and use it only to provide Lucy to that Clinic. Patients' rights over their information are set out in their Clinic's notice of privacy practices. Patients with questions should contact their Clinic.
What we collect about you
- From Google, when you sign in: your name, email address, whether Google has verified that address, and Google's identifier for your account. Lucy asks Google only for basic sign-in information (the "openid", "email" and "profile" scopes). We never receive your Google password, and Lucy cannot see your Gmail, Drive, Calendar, contacts or any other Google data.
- From your Clinic's administrator: your name, the Google account you sign in with, and your roles at the Clinic.
- A session cookie that keeps you signed in. It is needed for Lucy to work. Lucy uses no advertising or tracking cookies and no analytics.
- Audit records of each sign-in, sign-out, refused sign-in and change to who has access, with the time, your IP address and your browser's description of itself, and records of actions taken in Lucy. HIPAA's security rules require these.
- What you send us, for example an email to info@lucyai.dental.
How we use it
To sign you in and decide what you can see, to run, secure and support Lucy, to keep the audit trail, to investigate and respond to security incidents, and to meet our legal obligations. We do not sell personal information, we do not use it for advertising, and we do not use PHI for any purpose other than providing Lucy to the Clinic as its Business Associate Agreement and HIPAA allow.
Google user data
Lucy offers "Sign in with Google". This section sets out exactly what Lucy does with the information Google shares when you sign in.
- What Lucy accesses: your name, your email address, whether Google has verified that address, and Google's unique identifier for your account. These come from the "openid", "email" and "profile" scopes, which are the only ones Lucy requests. Lucy does not request, receive or store your Google password, and has no access to your Gmail, Google Drive, Calendar, Contacts, photos or any other Google data.
- How Lucy uses it: only to confirm who you are when you sign in, to check that your clinic has given you access, to show your name in Lucy, and to record who did what in Lucy's audit trail. Lucy does not use it for advertising, does not sell it, and does not use it to build profiles or train machine learning models.
- Where it is stored: in Lucy's database at Amazon Web Services in the United States, encrypted at rest, and sent only over encrypted connections.
- Who it is shared with: no one, except the service providers that host Lucy for us, when the law requires it, or to protect the security of Lucy and its users. People at Tek Hubs see it only where that is needed for security, to provide support you ask for, or to comply with the law.
- How long it is kept, and deleting it: while you have access to Lucy, and afterwards for as long as audit records refer to you (at least six years, which HIPAA requires of healthcare audit trails). You can ask us to delete your Google account information at info@lucyai.dental. We will delete it, or where the audit trail must be kept, remove your access and keep only what the law requires. You can also remove Lucy's access to your Google account at any time at myaccount.google.com/connections.
Lucy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Who we share information with
Only with the service providers that run Lucy for us, acting on our instructions, and with others only as described here:
- Amazon Web Services and our other hosting providers, where Lucy runs and its data is stored, in the United States.
- Stedi, the clearinghouse that sends benefit checks and claims to insurers and returns their answers.
- Sinch, which sends and receives faxes.
- Google, for sign-in. The sign-in page and these pages also load fonts from Google Fonts, which receives your IP address and browser details.
- Insurers and other payers, as needed to check benefits and process claims for the Clinic.
- Others where the law requires it, to protect the safety or security of people or of Lucy, or as part of a sale or reorganization of our business, which would remain subject to this policy and to the Clinics' agreements.
We require service providers that handle PHI to protect it as HIPAA requires, under a business associate agreement.
Security
Information travels encrypted (HTTPS), and the records Lucy keeps with Amazon Web Services are encrypted at rest. Access is limited to the people a Clinic or Tek Hubs has authorized, each signing in individually; Lucy signs people out after 15 minutes without activity; and audit records cannot be changed or deleted by the application. No system is perfectly secure. If a breach affects a Clinic's information, we will tell the Clinic as HIPAA and its agreement require.
How long we keep it
We keep your account information while you have access, and for as long as audit records refer to you: at least six years. Removing someone from a Clinic marks their record removed rather than deleting it, because the audit trail refers to it. Clinic data is kept, returned or destroyed as the Clinic's agreement and the law require.
Your choices
Your Clinic's administrator can update or remove your access. You can ask us about the account information we hold about you, or ask us to correct it, at info@lucyai.dental. Depending on where you live, you may have further rights, and we will respond as the law requires. Patients should make requests about their health information to their Clinic.
Children
Lucy is for the staff of healthcare practices. It is not directed to children, and we do not knowingly collect information from anyone under 16 as a user.
Changes
We may update this policy. We will post the new version here with a new effective date, and tell Clinics about material changes.
Contact
Tek Hubs LLC · info@lucyai.dental