Patient Privacy Policy

Last updated: November 11, 2026

1. Who this policy covers
   This Patient Privacy Policy describes how Otomo Health, Inc. (“Otomo,” “we,” or “us”) collects, uses, discloses, and protects information about you when you interact with our services because your healthcare provider (your “Provider”) uses Otomo. This includes phone calls answered or placed by our AI assistant on your Provider’s behalf, text messages we send on your Provider’s behalf, and web chat or forms your Provider offers through Otomo.
   If you are visiting our website, requesting a demo, or using Otomo as a member of a healthcare organization’s staff, our Privacy Policy at www.otomohealth.com/legal/privacy-policy applies instead.

   
   

2. Our role
   Otomo acts on behalf of your Provider. We are a business associate of your Provider under the Health Insurance Portability and Accountability Act (“HIPAA”) and operate under a Business Associate Agreement with them. Your Provider decides what communications you receive and remains responsible for your care and your medical records. Your Provider’s Notice of Privacy Practices governs how your health information may be used and shared; this policy explains Otomo’s part in that.

   
   

3. Information we collect
   We collect only what is needed to carry out the services your Provider has engaged us for. Depending on the service, this may include:
   Your name, phone number, and other contact details your Provider has on file.
   Appointment details, such as the provider you are seeing, the date and time, the office location, and the visit type.
   The content of your calls, text messages, and chats with our AI assistant, including recordings of calls where you have been told the call may be recorded.
   Your communication preferences, including your agreement to receive text messages, the date, time, and method by which you gave it, and any request to stop receiving them.
   Information you provide during a call or chat, such as a reason for calling, a question, or a request to reschedule, which we pass to your Provider.

   
   

4. How we use information
   We use your information only to provide the services your Provider has asked us to provide, which may include: confirming or reminding you of appointments; following up on care that is due; answering questions about office hours, locations, and appointment logistics; routing urgent matters to your Provider’s on call staff; collecting intake information; and responding to inquiries you submitted to your Provider.
   We also use information to honor your communication choices, to keep our systems secure, to detect and prevent fraud or misuse, and to comply with law.
   We do not use your information for marketing or advertising. We do not sell your information. We do not use your information to train general purpose artificial intelligence models.

   
   

5. Text messages
   Otomo sends text messages on behalf of healthcare practices that are our customers, to patients and prospective patients who have agreed to receive them. Messages may include appointment reminders and confirmations, links to intake forms, reminders for care that is due, and replies to inquiries you submitted to your Provider. We do not send marketing or promotional text messages under this program. Each message will identify your Provider.
   You may agree to receive text messages by checking the text message consent on your Provider’s intake, booking, or inquiry forms. You may also ask our assistant, during a recorded call we handle on your Provider’s behalf, to text you specific information, such as a form link or the office address. In that case we send only that message, and it does not sign you up for ongoing texts. When you agree during a call, we record the date, time, and the mobile number you agreed to be texted at, and we retain the call recording as the record of your agreement. Agreeing to receive text messages is not a condition of receiving care or of scheduling an appointment.
   Text messaging originator opt in data and consent will not be shared with any third parties, except with your Provider, on whose behalf we collect it, and with service providers that help us deliver text messages, including messaging platform providers and telecommunications carriers, solely for the purpose of delivering the messages you agreed to receive. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.
   You can stop receiving text messages at any time by replying STOP to any message. We also honor replies of CANCEL, END, QUIT, or UNSUBSCRIBE, and you can opt out by telling our assistant during a call or by contacting your Provider. Reply HELP to any message, or email info@otomohealth.com, for assistance. Message and data rates may apply. For the full terms of our text messaging program, see our SMS Terms at www.otomohealth.com/legal/sms-terms.

   
   

6. How we disclose information
   We disclose your information only in the following circumstances:
   To your Provider. We pass the content and outcome of your interactions to your Provider so they can act on them, for example to reschedule an appointment or return a call.
   To service providers. We use vendors that help us operate our services, such as cloud hosting, telephony, text message delivery, and artificial intelligence processing. These vendors may access your information only to perform services for us and are bound by Business Associate Agreements or confidentiality obligations. They may not use your information for their own purposes.
   As required by law. We may disclose information when required by law, subpoena, court order, or other legal process, or to protect the rights, property, or safety of Otomo, your Provider, you, or others, in each case only to the extent permitted by HIPAA and our agreement with your Provider.
   In a business transfer. If Otomo is involved in a merger, acquisition, or sale of all or part of its business, your information may be transferred to the successor entity to the extent permitted by HIPAA and our agreements with your Provider. The successor will be bound by this policy and by those agreements.
   We do not sell your information. We do not share your information with third parties for their marketing or advertising purposes. We do not disclose your information to data brokers or advertising networks.

   
   

7. HIPAA
   We comply with HIPAA with respect to Protected Health Information (“PHI”) we receive from or on behalf of your Provider. We enter into Business Associate Agreements with our Provider customers and with service providers that handle PHI on our behalf. We use and disclose PHI only as permitted by HIPAA and by our agreements with your Provider. Text messages we send are limited to the information needed for their purpose, such as the provider name, appointment date and time, office location, or a link to a form. Nothing in this policy limits the protections that apply to your PHI under HIPAA or under your Provider’s Notice of Privacy Practices.

   
   

8. Security
   We maintain administrative, technical, and physical safeguards designed to protect your information, including encryption in transit and at rest, access controls limiting access to authorized personnel, and regular security assessments. Otomo has completed a SOC 2 Type II examination. No method of transmission or storage is completely secure, and standard text messaging is not an encrypted channel.

   
   

9. Retention
   We retain your information for as long as needed to provide services to your Provider and as required by our agreements with them and by law. Records of your agreement to receive text messages, including call recordings where you agreed by phone, are retained for as long as you remain opted in, or, for a single message sent at your request during a call, from the date of that message, and in either case a period afterward sufficient to demonstrate consent if required. When information is no longer needed, we delete it or return it to your Provider in accordance with our Business Associate Agreement.

   
   

10. Your choices and rights
    Text messages. Reply STOP to any message to stop receiving texts, or tell our assistant during a call. Reply HELP for assistance.
    Phone calls. If you do not wish to receive calls from our assistant on your Provider’s behalf, tell the assistant during a call or contact your Provider directly.
    Your health records. Your rights to access, amend, or restrict your health information under HIPAA are exercised through your Provider, who holds your medical record. We will support your Provider in responding to those requests.
    Questions. You can contact us at info@otomohealth.com with questions about this policy. We will refer questions about your care or your records to your Provider.

    
    

11. Children
    Where your Provider treats minors, we may process a minor’s information on the Provider’s behalf. Communications about a minor’s care are directed to the parent or guardian your Provider has on file.

    
    

12. Changes to this policy
    We may update this policy from time to time. The effective date at the top shows when it was last revised. Material changes will be posted on this page.

    
    

13. Contact
    Otomo Health, Inc., 1 Broadway, 14th Floor, Cambridge, MA 02142. info@otomohealth.com.