PriorAuth Pilot Privacy Policy
Last updated October 19, 2026
1. Who This Policy Covers
This Privacy Policy explains how PriorAuth Pilot ("we") handles information in PriorAuth Pilot and on priorauthpilot.com.
- Website visitors and account users. This Policy covers information about people who visit our website, contact us, or use PriorAuth Pilot on behalf of an agency.
- Client health information. Information about an agency's clients is Protected Health Information (PHI). We handle PHI only as the agency's business associate, under our Business Associate Agreement (BAA) with that agency. The agency's own Notice of Privacy Practices tells its clients how their information is used.
2. Information We Collect
| Type | Examples | Where it comes from |
|---|---|---|
| Account information | Name, job title, work email, phone, agency name, NPI, Tax ID | The agency, at sign-up and in Settings |
| Client information (PHI) | Client name, date of birth, Medicaid ID, diagnosis, treatment documents, request details | Uploaded or entered by the agency's users |
| Billing information | Billing contact, plan, payment history | The agency and our payment processor. Card and bank numbers are handled by Stripe; we never see or store them. |
| Usage and device information | Sign-in times, pages used, actions taken, IP address, browser type | Collected automatically for security and activity logs |
| Messages | Support emails and inquiries | People who contact us |
We use only cookies needed to sign users in and keep the service secure. We do not use advertising or tracking cookies.
3. How We Use Information
- To provide PriorAuth Pilot: pre-filling forms, drafting summaries with AI assistance, building PDF packets and tracking status.
- To manage accounts, billing and support.
- To keep the service secure, including activity logs and detecting misuse.
- To improve the service using de-identified, aggregated usage information.
- To meet legal obligations.
We do not sell personal information or PHI, use it for advertising, or use it to train AI models.
4. How We Share Information
We share information only:
- With service providers that help us run PriorAuth Pilot, under written agreements: Amazon Web Services (hosting, storage and AI assistance, under a Business Associate Addendum), Stripe (payments, account and billing information only), Sinch (text messages to clinicians who turn on text alerts, and faxes for agencies with Fax Pro) and Notifyre (faxes for agencies with Fax or Fax Plus).
- With health plans, when an agency's user chooses to submit a request.
- When the law requires, such as a valid subpoena or court order, and only to the extent required.
- In a business transfer, if the PriorAuth Pilot business is sold or merged. The buyer must honor this Policy and the BAAs.
Text messages
Clinicians can choose to get text alerts from PriorAuth Pilot when a prior authorization review is waiting for their sign-off, and texts with their sign-in codes. We send texts only to people who turn on text alerts themselves in PriorAuth Pilot. Message frequency varies. Message and data rates may apply. Reply STOP to stop texts or HELP for help, or turn text alerts off in PriorAuth Pilot at any time. We use mobile numbers only to send these texts. We do not share or sell mobile numbers or text-message consent to anyone for marketing or promotional purposes.
5. How We Protect Information
- All information is encrypted in transit (HTTPS) and at rest.
- Information is stored in the United States.
- Each agency's data is kept separate and is visible only to that agency's users.
- Access is limited by role, sessions sign out after inactivity, and actions are logged.
- We follow the HIPAA Security Rule and report breaches as the BAA requires.
6. How Long We Keep Information
- Agency records are kept while the agency subscribes, then available for export for 30 days, then deleted within 60 days.
- Backups are deleted on a rolling schedule of no more than 35 days.
- Billing records are kept as long as tax law requires.
7. Your Choices
- Agency administrators can view, correct, export and delete their agency's records in PriorAuth Pilot.
- Account users can ask us to update or delete their own account information by emailing info@priorauthpilot.com.
- A client who wants to see or correct their health information should contact the agency that serves them. We will help the agency respond, as the BAA requires.
8. Children's Information
PriorAuth Pilot is for agency staff, not the public. Agencies may enter information about clients under 18 as part of their care. That information is PHI and is protected the same way as all other PHI.
9. Changes and Contact
We will post changes to this Policy on priorauthpilot.com and email agency administrators before material changes take effect.
PriorAuth Pilot
info@priorauthpilot.com