Privacy Policy

1. Who we are

ATTENDING AI LLC was founded by Dr. Scott Isbell, a practicing family physician. We operate this website (attendingai.health) and COMPASS — the Clinical Orientation and Multi-symptom Patient Acuity Screening System — a pre-visit assessment that captures your health story in a guided conversation, together with a portal where your provider reviews it before your visit.

2. What information we collect

• Symptom and assessment responses. What you tell COMPASS during a pre-visit assessment: your symptoms in your own words, your answers to follow-up questions, and relevant history you choose to share (for example, medications, allergies, or family history).
• Optional photos. If you choose to upload a photo (for example, of a rash or wound) to help your provider prepare, we collect that image. Uploading photos is always optional.
• Contact information. If you reach out through the contact options on this website — for example, to ask about a pilot or request a demo — we collect what you submit, such as your name, email address, and organization.
• Security and audit logs. Our systems record access events (who accessed what, and when) to protect your information and meet HIPAA audit requirements. These logs are operational, not marketing data.

3. How we use your information

We use assessment information for one purpose: preparing your provider for your visit. COMPASS organizes what you share into a clinical summary so your provider already knows your story before you walk in — and so you never have to repeat it.

We use contact-form submissions only to respond to your inquiry. We do not use any of your information for advertising, and we do not sell it — see Section 7.

4. AI processing

COMPASS uses AI to help organize what you share into a clear summary for your provider. Text and images you submit are processed by Azure OpenAI services running within Microsoft Azure — the same HIPAA-eligible cloud environment where your data is stored. Two commitments matter here:

• No patient data is used to train AI models — not ours, and not Microsoft's or OpenAI's. Your information is processed to prepare your visit summary and nothing else.
• AI output supports — never replaces — clinical judgment. Everything COMPASS prepares is reviewed by your licensed provider, who makes every clinical decision.

5. How your information is stored and protected

HIPAA-compliant. Encrypted. Audited. Specifically:

• Encrypted at rest in Microsoft Azure, using strong encryption (AES-256).
• Encrypted in transit using TLS 1.2 or higher on every connection.
• Role-based access — only the people who need your information to prepare your visit can see it.
• Audit trails — every access to health information is logged with user, timestamp, and context.

6. How long we keep your information

Health information handled on behalf of clinics is retained for a minimum of six years, consistent with HIPAA documentation requirements (45 CFR 164.530(j)) and our agreements with the clinics we serve. Encrypted backups follow the same protections. Contact-form submissions are kept only as long as needed to handle your inquiry and our business records. When retention periods end, data is securely deleted.

7. What we never do with your data

• We do not sell personal data — to anyone, for any reason.
• We do not use your information for advertising, and we do not share it with advertisers or data brokers.
• We do not use patient data to train AI models.

8. Cookies and analytics

This website sets no cookies and runs no analytics or advertising trackers. One technical note for completeness: our pages load fonts from Google Fonts, which means your browser requests font files from Google's servers (transmitting your IP address as part of any web request). The COMPASS application uses only the strictly necessary session storage required for an assessment to function — nothing for tracking.

9. Your rights and choices

You can request access to, correction of, or deletion of your personal information by contacting us (Section 12). We will respond consistent with applicable law and our retention obligations described in Section 6.

If you used COMPASS through your clinic, your clinic is the HIPAA "covered entity" responsible for your medical record, and its Notice of Privacy Practices also applies. For requests about your medical record itself, your clinic is often the fastest path — and we support clinics in fulfilling those requests.

10. Children's privacy

COMPASS is not directed to children. Assessments for minors should be completed by, or under the supervision of, a parent or legal guardian in connection with the child's care at a clinic. We do not knowingly collect personal information directly from children under 13 outside of that clinical context. If you believe a child has submitted information to us in error, contact us and we will delete it.

11. Changes to this policy

When we update this policy, we will post the revised version on this page and update the "Last updated" date above. Material changes that affect how patient information is handled will be communicated to the clinics we serve.

12. How to contact us

The most reliable way to reach us is the contact section on our home page. You may also write to attendingai@gmail.com.

This page describes our privacy practices in plain language; it is informational and is not legal advice.