Privacy Policy

Effective Date: October 12, 2026 | Last Updated: October 12, 2026

What changed (October 12, 2026): We added the categories of personal information we collect on our websites (server request logs with IP address and approximate location, our first-party visitor ID, Plausible analytics, Google Fonts, and the live voice demo), the information we collect when you sign up, a section on how we respond to Do Not Track and Global Privacy Control signals, a named list of our vendors on our subprocessors page, and the SMS clause in Section 7.5. We removed statements we could not confirm (that we honor Do Not Track, that every vendor is under a HIPAA contract, that a MyCare app is available in app stores, and that all data stays in the United States).

1. Introduction

InboundAI365, LLC (“IB365,” “we,” “us,” or “our”) is committed to protecting your privacy and the privacy of your patients. This Privacy Policy explains how we collect, use, disclose, store, and safeguard information when you visit our websites (including ib365.ai) or use the IB365 platform, including the CRM, Aveena AI voice receptionist, MyCare patient portal, SMS messaging, and all related services (collectively, the “Services”).

This Privacy Policy applies to website visitors, people who call or text us, healthcare practice administrators, staff, providers, and patients who access the MyCare portal. When we process patient information on behalf of a healthcare practice, the practice's own Notice of Privacy Practices and our Business Associate Agreement with that practice also apply.

2. Categories of Personal Information We Collect

2.1 Website visit data (all visitors). When your browser requests a page from our websites, including ib365.ai and the MyCare patient portal at mycare.ib365.ai, our server records the website address and page path you requested (including any query string), the referring page, your browser's user-agent string, your IP address, and the approximate country, region, and city that our hosting provider derives from your IP address. We record this for every page request, whether or not you accept analytics, to keep the site secure, troubleshoot problems, and understand traffic, including automated bots.

2.2 Analytics, only if you click “Accept all” (ib365.ai homepage). If you accept analytics in the banner on our homepage, we store a random visitor ID in your browser's local storage (ib365_vid) and a session ID in session storage (ib365_sid), and we send to our own servers the page URL, referrer, campaign (UTM) tags, how far you scrolled, how long you stayed, the buttons and links you clicked, your screen size, browser language, and device type, together with your IP address and approximate location. We also load Plausible Analytics, a cookieless analytics service that does not set cookies or build cross-site profiles. If you click “Decline non-essential,” neither runs. Your choice is stored in local storage (ib365_consent_v1).

2.3 Fonts. Our homepage loads fonts from Google Fonts, so your browser sends your IP address and browser information to Google when the page loads.

2.4 Live voice demo. If you start the “Talk to Aveena” demo on our homepage, your browser asks for microphone access and your voice is streamed to our voice AI provider, ElevenLabs, which records and transcribes the conversation so the AI can respond and so we can review it. The demo's code library is loaded from esm.sh when you start it. Don't share health information in the demo.

2.5 Calls and texts to IB365. Calls to our own line, (888) 252-3019, are answered by our AI assistant and are recorded and transcribed. We keep the phone number you call from, the recording, the transcript, and a summary.

2.6 Sign-up and onboarding (leads and customers). When you sign up or start onboarding, we collect your name, email address, phone number, password (handled by our sign-in provider), title, business name, business address, email, phone, and website, practice type, number of providers and patients, provider names, insurance accepted, current billing and phone carrier, and the name, title, IP address, user agent, and time recorded when you accept our Business Associate Agreement.

2.7 Practice and staff information. Practice name, address, phone number, email, specialty, provider details, business hours, insurance acceptance lists, service catalogs, operational configuration, and staff names, email addresses, phone numbers, roles, credentials, scheduling preferences, and sign-in credentials.

2.8 Patient information (PHI). When our AI systems and platform process patient communications and records on a practice's behalf, we handle Protected Health Information including names, dates of birth, phone numbers, email addresses, insurance information, appointment details, communication records, and any other information provided during calls, chats, or portal interactions. We process PHI only as a business associate of the practice, under our Business Associate Agreement.

2.9 Usage data in the Services. Login times, features accessed, pages viewed, AI queries submitted, call durations, API usage, and system performance metrics.

2.10 Communication data. Call recordings and transcripts, call summaries, SMS messages, chat transcripts, and email processed through the Services.

2.11 Payment information. Card details, billing address, and transaction history. Card data is processed by our payment processor, Stripe, and is not stored on IB365 servers.

3. How We Use Your Information

To provide, maintain, and operate the Services, including AI voice reception, patient portal, CRM, and SMS messaging
To process and manage patient calls, appointments, and communications on a practice's behalf
To respond to people who call us, try the voice demo, or start a sign-up
To authenticate users and maintain account security
To process payments and manage billing
To send administrative notifications about your account, service updates, and security alerts
To respond to support requests and provide customer service
To understand how our website is used and improve it (only with your consent for the analytics in Section 2.2)
To comply with legal obligations, including HIPAA, TCPA, and applicable state and federal laws
To detect, prevent, and address fraud, abuse, security issues, and technical problems
To generate de-identified, aggregate analytics to improve the Services (see Section 9)
To enforce our Terms of Service and protect the rights, property, and safety of IB365, our users, and the public

4. HIPAA and Business Associate Agreements

When we process PHI for a healthcare practice, IB365 acts as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA). We maintain administrative, physical, and technical safeguards designed to protect PHI, and we sign a Business Associate Agreement (BAA) with each healthcare practice before we process its PHI.

IB365 will report any breach of unsecured PHI to the affected practice within thirty (30) calendar days of discovery, and will cooperate with the practice in fulfilling breach notification obligations to affected individuals and the U.S. Department of Health and Human Services.

5. AI Data Processing

5.1 How AI Processes Data. The Aveena voice receptionist and CRM AI chat assistant process conversation data using third-party AI providers, which are named on our subprocessors page. When a patient calls or chats, conversation data is sent to those providers for speech recognition, language understanding, and response generation. The AI then carries out actions (scheduling, lookups, etc.) against the practice's database.

5.2 Model Training. IB365 does not use PHI, patient data, or Customer Data from one customer to train, fine-tune, or improve AI models used for other customers.

5.3 Data Retention by AI Providers. Our AI providers may keep conversation data for limited periods under their own terms (for example, to detect abuse or, for voice, to store call recordings and transcripts in the practice's account). Contact us for the current retention settings for a specific provider.

5.4 Automated Decision-Making. The Services use automated processing to schedule appointments, route calls, update records, and generate responses. These automated actions are administrative in nature and do not involve clinical decision-making. Practices can review, modify, or override any automated action.

6. Data Security

We use security measures that include:

AES-256 encryption for data at rest
TLS 1.2+ encryption for data in transit
PostgreSQL row-level security (RLS) for multi-tenant data isolation at the database level
Role-based access controls (RBAC) with least-privilege enforcement
Audit logging of data access
Automatic session management with configurable timeout
Rate limiting and brute-force protection on authentication endpoints
Incident response procedures

No method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we protect your information using commercially reasonable measures.

7. Data Sharing & Third Parties

We do not sell or share personal information (including for cross-context behavioral advertising). We disclose information to third parties only in these circumstances:

7.1 Service providers (subprocessors). We use vendors to host, store, and deliver the Services: website and application hosting, databases, file storage, sign-in, payments, voice AI, AI language models, telephony and SMS, email, website analytics, and web fonts. Each vendor, what it does, the data it receives, and its Business Associate Agreement status are listed on our subprocessors page. Vendors that may receive PHI are used only under a BAA or are being brought under one; contact us for the current status of any vendor.

7.2 Legal Requirements. We may disclose information when required by law, subpoena, court order, or governmental regulation, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

7.3 Business Transfers. In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will provide notice before your information becomes subject to a different privacy policy.

7.4 With Your Consent. We may disclose information to third parties when you have given explicit consent.

7.5 Mobile Information and SMS. Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. SMS opt-in data and consent will not be shared with or sold to any third parties. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Your phone number and mobile device information collected through the Services, including the MyCare patient portal, AI receptionist, and SMS messaging features, will only be used to provide the communication services you have consented to receive. See our SMS Terms.

7.6 MyCare Mobile Application. Where a practice offers MyCare as an installed mobile app, the app collects your phone number and date of birth for identity verification. If you enable biometric login (Face ID, Touch ID, or fingerprint), a cryptographic token is stored in your device's secure keystore; no biometric data is sent to or stored on our servers. Push notification tokens are stored to deliver appointment reminders, and you can turn notifications off in your device settings. The app does not track you across other apps or websites.

8. Cookies, Local Storage & Tracking

8.1 CRM Application. The IB365 CRM uses cookies set by our sign-in provider for authentication and session management. These are essential for the application to work.

8.2 MyCare Patient Portal. The MyCare portal uses browser session storage for session tokens. No advertising or cross-site tracking tools are used on the patient portal. Page requests to the portal are logged as described in Section 2.1.

8.3 Marketing Website. Our marketing website does not set advertising cookies. It uses local storage and session storage for your consent choice and, only if you click “Accept all,” for the first-party visitor and session IDs and Plausible analytics described in Section 2.2. Server request logging (Section 2.1) and Google Fonts (Section 2.3) run for every visitor.

8.4 Third-party tracking over time and across sites. We do not allow advertising networks, pixels, or other third parties to collect personal information about your online activities over time and across different websites through our websites. Plausible does not use cookies or track you across sites. Google (fonts), ElevenLabs (voice demo), and esm.sh (demo code) receive your IP address and browser information when your browser contacts them; their own privacy policies govern what they do with it.

8A. How We Respond to Do Not Track and Global Privacy Control Signals

Do Not Track. Our websites do not currently change their behavior when your browser sends a Do Not Track (DNT) signal. Instead, the analytics in Section 2.2 run only if you click “Accept all,” and you can decline them in the banner. Server request logging (Section 2.1) runs regardless of DNT.

Global Privacy Control (GPC). We treat a Global Privacy Control signal as a valid request to opt out of the sale or sharing of your personal information. Because we do not sell or share personal information and our websites load no cross-site advertising trackers, there is currently nothing for a GPC signal to switch off; if that ever changes, we will honor GPC as an opt-out before any sale or sharing occurs.

9. De-identified & Aggregate Data

We may create de-identified, aggregate data from information collected through the Services. De-identified data cannot reasonably be used to identify any individual or practice. We may use such data for service improvement, benchmarking, analytics, and research purposes. De-identified data is not subject to this Privacy Policy or the restrictions on PHI.

10. Data Retention

We retain information as follows:

Customer Data & PHI: Retained for the duration of your subscription plus thirty (30) days post-termination for export. Permanently deleted after thirty (30) days. Backups purged within ninety (90) days.
Call recordings and transcripts: Retained according to the practice's configured retention settings and the practice's own legal obligations, subject to the 30-day deletion after termination above.
Website request logs and analytics events (Sections 2.1 and 2.2): Kept for security, troubleshooting, and traffic analysis. We have not yet set a fixed deletion schedule for them; you can ask us to delete records tied to your IP address or visitor ID.
Voice demo and calls to our own line: Recordings and transcripts are kept in our voice provider's account until we delete them; you can ask us to delete yours.
SMS consent records: Retained for a minimum of four (4) years per TCPA requirements.
Audit logs and HIPAA compliance documentation: Retained for a minimum of six (6) years.
Payment records: Retained as required by tax and financial regulations.
Account information: Retained for thirty (30) days post-termination, then deleted.

11. Your Rights

Depending on your location and applicable law, you may have the following rights:

Access: Request a copy of the personal information we hold about you
Correction: Request correction of inaccurate or incomplete information
Deletion: Request deletion of your personal information, subject to legal retention requirements
Data Portability: Request your data in a machine-readable format (CSV, JSON)
Restrict Processing: Request that we limit how we use your information
Object: Object to certain processing activities
Withdraw Consent: Where processing is based on consent, withdraw consent at any time
Non-Discrimination: We will not discriminate against you for exercising any privacy rights

To exercise any of these rights, contact us at privacy@ib365.ai. We will respond within thirty (30) days. For HIPAA-related requests, please work with your healthcare practice directly, as they are the Covered Entity responsible for your medical records.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights:

Reviewing or changing your information: Customers can review and update much of their account and practice information in the CRM. Anyone can ask us to review, correct, or delete personal information by contacting privacy@ib365.ai.
Right to Know: You may request the categories and specific pieces of personal information we have collected about you.
Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
Right to Opt-Out of Sale or Sharing: We do not sell or share personal information. We do not share personal information for cross-context behavioral advertising. We treat Global Privacy Control signals as an opt-out (see Section 8A).
Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA rights.
Right to Correct: You may request correction of inaccurate personal information.
Right to Limit Use of Sensitive Information: You may limit our use of sensitive personal information to purposes necessary for providing the Services.

To exercise these rights, contact privacy@ib365.ai or call (888) 252-3019. We will verify your identity before processing requests.

13. Children's Privacy

Our websites and the Services are not directed at children under the age of thirteen (13). We do not knowingly collect personal information from children under 13. The MyCare patient portal may be accessed by minor patients for appointment viewing, but such access is managed through the parent/guardian's practice relationship. If we learn that we have collected personal information from a child under 13 without parental consent, we will delete that information promptly. Contact us at privacy@ib365.ai if you believe we have inadvertently collected information from a child.

14. International Data Transfers

The Services are operated from and intended for use within the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. Some of our vendors may process data in other countries under their own terms; contact us for where a specific vendor processes data.

15. Data Breach Notification

In the event of a data breach involving unsecured PHI or personal information, IB365 will: (a) investigate the breach promptly; (b) notify affected Customers within thirty (30) calendar days of discovery; (c) provide details about the nature of the breach, types of information involved, and steps taken; (d) cooperate with Customers in notifying affected individuals and regulatory authorities as required by HIPAA, state breach notification laws, and other applicable regulations; and (e) take steps to mitigate harm and prevent future breaches.

16. Do Not Sell or Share My Personal Information

We do not sell or share personal information. We do not sell, rent, lease, or trade personal information or PHI to any third party for monetary or other valuable consideration. We do not share personal information for cross-context behavioral advertising or targeted marketing by third parties.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, and we summarize what changed at the top of this page. We will notify you of material changes by: (a) posting the updated policy on this page with a new “Last Updated” date; and (b) for customers with an account, sending an email to the address on the account or displaying a notice within the Services. Your continued use of the Services after the effective date of changes constitutes acceptance of the updated policy.

18. Contact Us

For questions about this Privacy Policy, data practices, or to exercise your privacy rights:

InboundAI365, LLC
11344 Coloma Rd
Gold River, CA 95670
Privacy inquiries: privacy@ib365.ai
General: info@ib365.ai
Phone: (888) 252-3019
Web: ib365.ai