Privacy policy

Stitch Care, Inc. ("Stitch") is a team of nurse coordinators, supported by an automated texting assistant, who stay in touch with transplant patients by text message after they leave the hospital. Transplant centers hire us to do this for their patients. This Policy explains what information we have, why we have it, who can see it, and what you can do about it.

It is organized for the three groups who read it: patients and caregivers (Part A), transplant center staff (Part B), and website visitors (Part C). Parts D and E apply to everyone.

• Your transplant center enrolled you and your coordinator entered your information. The center still owns your medical record.
• Many of the texts you get are written and sent by our automated assistant. Your nurse coordinator can see every conversation and steps in when a message needs a person.
• Your messages, photos you text us, and recordings of calls with your coordinator are kept as part of your care record.
• We never sell your information and never use it for advertising. It is not used to train the AI models we use.
• Text STOP at any time to stop messages. Texting is not for emergencies; call 911.
• Questions: privacy@stitchcare.io.

How you got here

Your transplant center chose Stitch to help with your care after transplant. Under the health privacy law called HIPAA, your transplant center is the "covered entity," which means it is responsible for your medical record and for the privacy notice you received from the hospital. Stitch is the center's "business associate," which means we work under a written agreement with your center and follow the same privacy rules. A Stitch coordinator enrolls you; you do not sign up on your own, and nothing is sent to you until you reply YES to our first text.

What we know about you, and where it comes from

• Entered by your coordinator from what your transplant center provides: your name, date of birth, phone number, email, home address, preferred language, medical record number, insurance plan and policy number, transplant type and date, medications and doses, allergies, other health conditions, risk level, lab schedule and results, and the name of your care team.
• From you, by text: everything you write to us, including how you feel, symptoms, readings you report, medication and appointment check-ins, and questions. Any photos or videos you text us are stored with your messages.
• From phone calls: calls between you and your coordinator may be recorded and transcribed so the details go into your care record. Your coordinator will tell you when a call is being recorded.
• From a wearable device, only if you choose to connect one: sleep, heart rate, blood oxygen, temperature, activity, and readiness readings.
• Created automatically: when each text was sent and delivered, and records of who on our team viewed or changed your information.

Who sees your messages

Your Stitch nurse coordinator can read every message in your conversation and replies when a person is needed. Your transplant center's clinicians can also see your messages, symptoms, readings, and summaries in our care team dashboard. Other Stitch staff see your information only when they need it to run the service or fix a problem, and we keep a record of who looked.

How our automated assistant takes part

Some of the texts you receive are written and sent by our automated assistant without a nurse reading them first. The assistant sends scheduled reminders and check-ins from your care plan, answers routine questions using education materials approved for your type of transplant, and acknowledges the readings and updates you send. It can also set, change, or cancel reminder texts when you ask.

The assistant sorts every message you send by how urgent it is. Messages about symptoms, worries, or anything a nurse should see are flagged for your coordinator to review. When the assistant is not confident in an answer, it tells you it is checking with a nurse, and your coordinator writes the reply. If a message suggests an emergency or you ask to speak with a nurse, the assistant sends an immediate response, pauses automated messages, and alerts your coordinator right away.

The assistant does not make decisions about your care. Those stay with your nurse coordinator and your transplant team. If you would rather talk to a person at any point, say so in a text and a coordinator will reach out.

The assistant uses artificial intelligence models run inside our HIPAA-covered Amazon Web Services environment. Your information, including your messages and care record, is shared with those models so they can respond to you. It is not used to train them. When a coordinator corrects one of the assistant's answers, we may turn the correction into a general guideline with your identifying details removed so the assistant answers better for everyone.

What we do with your information

We use your information for one purpose: to help you recover after transplant the way your transplant team planned. That means sending reminders and check-ins, answering your messages, watching for warning signs, writing summaries for your care team, and alerting your transplant team when something is off. We also keep records the law requires us to keep.

What we do not do: sell your information, share it with advertisers, use it to market anything to you, or give it to anyone outside your care unless the law requires it.

Caregivers

You can name one caregiver, such as a family member, to be part of your Stitch service. Nothing is shared with them until you give permission, and you choose what they can see and do: view your readings, receive alerts when something urgent comes up, or confirm tasks for you. Your caregiver must also agree to receive texts. They have their own text conversation with us, and you can remove them or change their permissions at any time by telling your coordinator.

Who else handles your information

We rely on a small number of companies to run our systems: a cloud hosting provider that also runs our AI models, a database provider, and a text messaging and telephone provider whose speech-to-text service transcribes recorded calls. If you connect a wearable, it sends us your readings from your own account with that company. Every provider is bound by a written contract and may use your information only to provide its service to us. A current list of these companies is available at trust.stitchcare.io.

We may also share information when the law requires it, for example in response to a court order, or to prevent serious harm to someone's health or safety. If Stitch is ever acquired, your information stays protected by this Policy and by our agreements with transplant centers.

Texting rules

• Your transplant center enrolled your phone number. By replying YES to our first message, you agree to receive care coordination texts from Stitch.
• How often we text depends on your care plan. Message and data rates from your phone carrier may apply.
• Text STOP to stop all messages. Text HELP for help. If you stop, please tell your transplant center so they can reach you another way.
• Texting is not for emergencies. Messages may not be read by a person right away. If you have an urgent or life-threatening problem, call 911 or go to the nearest emergency room.

The Stitch patient website

You can also sign in at patient.stitchcare.io with your phone number and a one-time code we text you. There is no password to create. On the site you can see today's reminders and connect or disconnect a wearable device. Your conversation with your coordinator happens by text, not on the site.

Your rights

HIPAA gives you the right to see and get a copy of your health information, to ask us to correct it, to ask for a list of certain times it was shared, to ask for limits on how it is used, and to complain. Because your transplant center holds your medical record, the center handles these requests. You can start with the center, or email privacy@stitchcare.io and we will pass your request to the center within two business days and help them answer it.

You can also complain to the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr. We will never treat you differently for complaining.

Some states give you extra privacy rights. Email privacy@stitchcare.io to use them. We answer within 30 days.

How long we keep your information

We keep your information while you are enrolled and afterward for as long as our agreement with your transplant center and the law require. HIPAA requires us to keep certain records for six years. After that, we delete the information or strip out anything that identifies you. Backup copies are deleted on a rolling schedule.

Children

Stitch enrolls adults. A patient under 18 can take part only through a parent or legal guardian working with the transplant center. If you think we have information about a child outside that arrangement, email privacy@stitchcare.io and we will remove it.

If you use the Stitch care team dashboard, we hold your name, work email, phone number, role, and a log of what you do in the dashboard, including which patient records you open and which messages you read. We use this to give you access, to keep patient information secure, and to meet audit requirements. Your access is limited to your own center's patients. Your center's agreement with Stitch governs how its patient information is handled; this Policy adds to that agreement and does not replace it. Access logs are kept for at least six years.

stitchcare.io uses the cookies needed to make the site work and basic analytics that tell us which pages are visited. We do not use advertising cookies and we do not sell visitor information. If you fill in a contact form or schedule a demo, we use what you give us to respond to you and to follow up about working with Stitch.

• Information is encrypted while it travels (TLS 1.2 or higher) and while it is stored (AES-256).
• Only people who need access get it, and every staff account requires multi-factor authentication.
• We keep records of which staff members opened patient records and read messages, and of every change to a care plan or a clinical value.
• An independent auditor examines our controls every year (SOC 2 Type II), an outside firm tests our defenses every year, and our systems are monitored continuously.
• Every team member completes HIPAA and security training and signs a confidentiality agreement.

Our current security reports are available at trust.stitchcare.io. No system is perfectly secure. If a breach affects your information, we will notify your transplant center as our agreements and the law require, and the center will notify you.

United States only. Stitch serves transplant centers in the United States and keeps all information on servers in the United States. We do not offer the service outside the United States.

Changes. When we update this Policy, we post the new version here with a new effective date. For significant changes, we post the new version at least 15 days before it takes effect and tell transplant centers directly.

Contact. Privacy questions and requests: privacy@stitchcare.io (our HIPAA Privacy Officer). Security concerns: security@stitchcare.io. Anything else: hello@stitchcare.io. Stitch Care, Inc.