Privacy Policy

Effective date: September 19, 2026

1. Who we are

Sidekick Labs LLC operates Samantha Medical and the Samantha Virtual Front Desk service ("Samantha," "we," "us," or "our"). Samantha provides a virtual front desk receptionist service to medical practices. Samantha answers calls on behalf of a participating practice, schedules and cancels appointments, takes messages for practice staff, and sends related notifications by SMS text message to practice personnel who have opted in. At participating practices without electronic medical record access, Samantha also corresponds directly with patients by SMS text message to collect and relay their requests.

This Privacy Policy describes what information we collect, how we use it, and how we protect it. Questions about this policy can be sent to info@samantha-medical.com.

2. Information we collect

We collect only the information needed to operate the receptionist service:

• Call information. The caller's phone number (caller ID), the date and time of the call, call audio processed in real time to conduct the conversation, and a transcript of the conversation.
• Scheduling information. The caller's name, callback number, requested provider, appointment date and time, and the stated reason for the visit, as needed to book, change, or cancel an appointment.
• Identity confirmation. Full name and date of birth, used solely to verify a caller's identity before an existing appointment is discussed or changed.
• Messages. The content of messages a caller asks Samantha to relay to the practice, such as callback requests or questions for staff.
• SMS program information. For practice staff who opt in to SMS notifications: the mobile phone number provided and the opt-in consent record. For patients who text a practice's Samantha number: the mobile phone number and the message content of that conversation.

We do not collect information for advertising, and we do not build marketing profiles of callers.

Website analytics. This public website (www.samantha-medical.com) uses Google Analytics and Microsoft Clarity to understand how visitors find and use the site, such as pages viewed, links clicked, and how visitors scroll and interact with pages. Clarity may record anonymized session replays and heatmaps of visitor interactions. These tools set cookies and process visitor data under Google's privacy policy and Microsoft's privacy statement. Analytics is used on this marketing website only. It is never used in the receptionist service, the staff application, or any system that handles patient or health information.

3. How we use information

Information is used exclusively to deliver the service:

• To answer calls and schedule, change, or cancel appointments in Samantha Hub, a connected calendar, or a configured electronic medical record (EMR) system where available.
• To recognize returning patients by their verified caller ID and greet them appropriately.
• To relay messages from callers to the practice's staff.
• At practices without a calendar or EMR connection, to correspond with patients directly by SMS to collect a message or appointment request and relay it to practice staff.
• To send service notifications by SMS to practice staff who have opted in. These notifications are intentionally minimal: they state only that a new message exists and never include patient names, message content, or other health information.
• To maintain the security, quality, and auditability of the service, including required audit logs.

4. What we do not do

We do not use caller information, transcripts, or messages for advertising, and we do not permit our service providers to use your information for their own purposes.

5. Service providers

We use a small number of infrastructure providers strictly to operate the service, such as telephone and SMS carriage and cloud-hosted voice and language processing. Where the service handles protected health information, providers are used under HIPAA Business Associate Agreements and configured for HIPAA-eligible processing. Service providers receive only the information necessary to perform their function and are contractually prohibited from using it for anything else.

6. Protected health information (HIPAA)

When Samantha operates on behalf of a medical practice, call recordings, transcripts, and scheduling details may constitute protected health information (PHI) under HIPAA. In that role we act as a business associate of the practice and handle PHI according to our agreement with the practice and applicable law, including:

• Processing PHI only on HIPAA-eligible, BAA-covered infrastructure hosted in the United States.
• Verifying caller identity before discussing or changing any appointment.
• Keeping notification messages free of PHI; message content is available only in an authenticated console.
• Redacting caller speech and phone numbers from system logs.
• Retaining records only as long as required by the practice and by law, with audit records kept per HIPAA documentation requirements.

7. Data retention

Call transcripts, interaction summaries, and messages are retained for the period set by the participating practice and are then purged automatically. Audit records are retained for six years in accordance with HIPAA documentation retention requirements. SMS opt-in and opt-out records are retained as required by carrier and regulatory rules.

8. Security

We protect information with authenticated access controls, signed and verified webhooks, rate limiting, deterministic input validation, and least-privilege access to backend systems. No method of transmission or storage is perfectly secure, but the service is designed so that a non-compliant configuration refuses to operate.

9. Your choices and rights

• SMS opt-out. Practice staff and patients receiving SMS messages can reply STOP at any time to stop receiving messages, or HELP for assistance. See our Terms and Conditions for full SMS program details.
• Patients. Requests to access, correct, or delete health information should be directed to your medical practice, which controls its patient records. We support the practice in fulfilling such requests.
• Questions. Contact us at info@samantha-medical.com for any privacy question or concern.

10. Children

The service is not directed to children. Appointment calls concerning a minor are handled by the practice's own policies, with information used solely for scheduling.

11. Changes to this policy

If we change this policy, we will post the updated version at this address with a new effective date. Material changes affecting participating practices will be communicated to them directly.

12. Contact

Sidekick Labs LLC
Samantha Medical
Email: info@samantha-medical.com