Privacy Policy

Last updated November 3, 2026.

1. Introduction

Timber Health, Inc., a Delaware C corporation and developer of the Captrix platform ("Captrix," "we," "our," or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our practice-management and patient-engagement platform and related services (the "Service").

Captrix is a provider-facing application intended for use by healthcare practices and their authorized staff. It is not intended as a direct-to-patient application; patient-facing surfaces (forms, booking pages, chat) are operated on behalf of the provider and governed by the provider's own notice of privacy practices.

By using Captrix, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide

Account information (name, email address, phone number, practice name)
Billing information (payment card details, billing address)
Practice information (specialty, location, EHR system)
Patient data you upload or integrate with our platform
Communications with our support team

2.2 Information Collected Automatically

Device information (IP address, browser type, operating system)
Usage data (features accessed, actions taken, time spent)
Cookies and similar tracking technologies
Log data and analytics information

2.3 Information from Third Parties

Data from systems the practice chooses to connect (with the practice's explicit authorization, see Section 6)
Information from marketing platforms you connect
Data from analytics and advertising partners

3. How We Use Your Information

We use collected information to:

Provide, maintain, and improve our services
Process transactions and send related information
Send marketing communications (with your consent)
Respond to your comments, questions, and support requests
Analyze usage patterns to enhance user experience
Detect, prevent, and address technical issues and fraud
Comply with legal obligations

Information retrieved from a connected system is used only to provide the requested feature to the authenticated provider (e.g., displaying an appointment, populating a scheduling field). It is not used to train models, sold, or shared with third parties outside the limited service-provider scope described in Section 4.

4. Data Sharing and Disclosure

We may share your information with:

Service providers: Third parties who perform services on our behalf (hosting, analytics, payment processing) and who are bound by confidentiality and HIPAA Business Associate obligations where applicable.
Business partners: EHR systems and marketing platforms you choose to integrate.
Legal requirements: When required by law or to protect our rights.
Business transfers: In connection with a merger, acquisition, or sale of assets.

We do not sell your personal information to third parties. We do not use protected health information (PHI) for advertising or model training.

4.1 Mobile Information and SMS

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties or affiliates.

Mobile phone numbers and SMS consent records are used only to deliver the appointment and care-related messages the practice you interact with is authorized to send, and to honor your opt-out. Consent is recorded per practice and is never shared between practices. Message frequency varies; message and data rates may apply. You may reply STOP at any time to opt out, or HELP for help. Full details of how consent is collected are published at captrix.ai/sms-opt-in.

5. HIPAA Compliance

As a service provider to healthcare practices, we understand the importance of protecting patient health information. Captrix:

Enters into Business Associate Agreements (BAAs) with covered entities
Implements administrative, physical, and technical safeguards
Maintains audit trails and access controls
Provides breach notification as required by law
Trains employees on HIPAA requirements

6. Connected Systems and EHRs

Captrix is practice management and e-prescribing software. It does not keep clinical exam notes and is not an ONC-certified electronic health record. A practice may connect other systems to Captrix, such as its email inbox, calendars, payment processor, advertising accounts or e-prescribing partner. Captrix does not currently connect to any practice's EHR.

Connections are started by an authenticated practice user and use OAuth or the vendor's own authorization. Captrix never asks for or stores the passwords to those systems, requests only the access needed for the features the practice enables, and keeps any client secrets encrypted and out of browser code.

Data from connected systems is encrypted in transit and at rest.
Views of patient records in Captrix are recorded in an access log the practice owner can review.
A practice can disconnect a connected system at any time; Captrix deletes the related access tokens and any cached data within 30 days.
Patient information from connected systems is never used to train machine-learning models, never sold, and never shared with advertising or analytics partners.

7. Data Security

We implement industry-standard security measures including:

Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
Regular security assessments and penetration testing
Access controls, multi-factor authentication, and least-privilege principles
Secure cloud infrastructure with documented physical security (AWS data centers)
Employee security training and background checks

8. Data Retention

We retain your information for as long as your account is active or as needed to provide services. We may retain certain information as required by law or for legitimate business purposes, such as resolving disputes and enforcing agreements. PHI retrieved via EHR integrations is deleted within 30 days of connection revocation or account termination, as described in Section 6. Accounting connections are covered in Section 15.

9. Your Rights and Choices

Depending on your location, you may have the right to:

Access the personal information we hold about you
Correct inaccurate or incomplete information
Delete your personal information
Object to or restrict certain processing
Data portability
Withdraw consent where processing is based on consent
Opt out of marketing communications
Disconnect connected systems at any time from your Captrix Settings page

To exercise these rights, please contact us at jack@captrix.ai. Patients whose information is processed by Captrix on behalf of a healthcare provider should direct access, correction, or deletion requests to that provider, who is the data controller.

10. Cookies and Tracking

We use cookies and similar technologies to:

Keep you logged in
Remember your preferences
Understand how you use our services
Improve and personalize your experience

You can control cookies through your browser settings. Note that disabling cookies may affect functionality. We do not place advertising or cross-site tracking cookies on pages that surface PHI.

11. Children's Privacy

Captrix is intended for use by adult healthcare professionals. We do not knowingly collect personal information directly from children. Pediatric patient information processed on behalf of a provider is treated as PHI and governed by the provider's notice of privacy practices and applicable law.

12. International Data Transfers

Captrix processes data in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy and applicable law.

13. ONC Model Privacy Notice

Captrix's data practices align with the Office of the National Coordinator for Health Information Technology (ONC) Model Privacy Notice. The following summarizes the standard ONC categories as applied to Captrix:

How this app accesses, uses, and discloses your data: Captrix accesses data that the practice enters or connects; uses data to power scheduling, patient engagement, and workflow features the provider has enabled; and discloses data only to subprocessors bound by HIPAA Business Associate agreements (Section 4).
Data the app collects: See Sections 2 and 6.
Whether data is shared with third parties: Only with service providers under BAA, never with advertisers or data brokers (Section 4).
Whether data is sold: No (Section 4).
Whether data is de-identified or aggregated for any purpose: Captrix may produce de-identified, aggregated usage statistics for product improvement; PHI is never used to train ML models.
Security practices: See Sections 5 and 7.
How to revoke access: Providers may disconnect connected systems from Captrix Settings at any time; Captrix deletes associated tokens and cached data within 30 days (Section 6).
How to contact the app developer: jack@captrix.ai (Section 16).
Whether data is encrypted in transit and at rest: Yes , TLS 1.2+ in transit, AES-256 at rest.
App developer's breach-notification practices: Captrix follows HIPAA Breach Notification Rule timing (notice to covered entity within 60 days of discovery).

14. Advertising, Social & Google Integrations

Captrix lets a practice connect its own advertising and social accounts (Google Ads, Meta, Google Business Profile, YouTube, LinkedIn and TikTok) to show the practice how its own ads, posts, videos and listings are performing next to the leads and patients they produced, and to bring the leads people submit on the practice's own lead forms into its Captrix account. Captrix only reads these accounts: it never posts, replies, comments or changes anything on them, and it sends them no lead, patient or conversion data. These connections are initiated by an authenticated practice user using OAuth 2.0; Captrix never receives or stores the practice's advertising-account password.

14.1 Google Ads

For practices that connect a Google Ads account, Captrix requests one scope, https://www.googleapis.com/auth/adwords, used through the Google Ads API to read the practice's own advertising reports: the accounts it can access, their names and IDs, and its campaigns, ad groups, ads and keywords with their performance figures (such as impressions, clicks, cost and conversions). Google does not offer a read-only Ads scope, so this is the narrowest scope that allows these reports.

How Captrix uses Google user data.

Advertising reports are used only to show the practice its own advertising results inside Captrix, for example cost per lead or cost per new patient by campaign. They are shown only to that practice's authorized users.
Captrix never creates, edits, pauses or deletes the practice's campaigns, ads, ad groups, keywords, bids, budgets or targeting.
Google user data is never sold, never used to serve or target advertising, never used to train machine-learning models, and never shared with third parties except the service providers that host Captrix under confidentiality obligations.
The OAuth refresh token is stored encrypted at rest. Captrix stores the practice's own report figures in its encrypted database, refreshed nightly, so the practice can see its history: daily cost, impressions, clicks and conversions per campaign, ad group, ad and keyword; the ads' structure and text (headlines, descriptions, landing pages, keywords and quality scores); aggregated breakdowns that Google reports (such as age range, gender, region, device and hour); and the search terms that triggered its ads. These figures are aggregates; they identify no individual. Captrix keeps up to 24 months of them.
A practice can disconnect at any time from Captrix Settings → Ad spend, which deletes the token and every report figure read from that account and revokes Captrix's access. A practice can also ask for this deletion by emailing jack@captrix.ai.

Captrix's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

14.2 Meta (Facebook and Instagram)

A practice can sign in with Facebook to let Captrix read reports from its own Meta ad accounts (the ads_read permission): account names and IDs, and its campaigns, ad sets and ads with their text, landing pages and daily performance figures (spend, impressions, reach, frequency, clicks, leads, video plays) and Meta's aggregated breakdowns (such as age range, gender, region, placement and device). The access token is stored encrypted at rest. These reports are stored and handled under the same rules as Google Ads reports above: refreshed nightly, kept up to 24 months, shown only to the practice, never sold or used for advertising or model training, never used to change the practice's ads, and deleted when the practice disconnects. To have this data deleted, disconnect Meta in Captrix Settings → Ad spend, or email jack@captrix.ai.

Meta lead forms and posts. A practice can also connect one Facebook Page it manages. With the permissions leads_retrieval, pages_show_list, pages_read_engagement and pages_manage_metadata, Captrix lists the Pages the person manages so they can choose one, subscribes that Page to Meta's new-lead notifications, and receives each lead a person submits on the practice's own Facebook or Instagram lead forms from the day of connection on. A lead is the practice's patient information from the moment Captrix receives it: it is encrypted, access-audited, protected under HIPAA like every other lead, and never sent back to Meta. With the optional permissions read_insights, instagram_basic and instagram_manage_insights, Captrix also reads the Page's and its linked Instagram professional account's own posts and Stories with their counts (likes, comments, shares, saves, reach and views), the accounts' follower counts and 28-day totals, and Instagram's aggregated follower breakdown by age, gender and city. Captrix never reads the text of comments, who commented, who is tagged or mentioned, or private messages. Captrix stores these posts and figures so the practice can see its history: every post with its insights, refreshed daily for 30 days, weekly to 90 days and monthly to two years; Stories while they are live (Meta removes them after 24 hours); and the accounts' daily follower, reach and engagement figures and weekly aggregated audience breakdowns. They are kept while the Page is connected, and are deleted on disconnect, when Meta no longer returns a post, or when they have not been refreshed for 30 days. The Page token is stored encrypted at rest. Disconnecting the Page in Captrix Settings → Ad spend unsubscribes it from lead notifications and deletes the token and the posts and figures read with it; leads already filed are part of the practice's records and kept under its retention rules.

14.3 Google Business Profile

A practice can connect its own Google Business Profile. Captrix requests one scope, https://www.googleapis.com/auth/business.manage, and uses it read-only to: list the Business Profile accounts and locations the practice manages, so it can choose which to connect; read each connected location's public reviews (star rating, the reviewer's display name, the review text, dates, and whether the practice has replied) and its overall rating; read the location's performance figures from Google (calls, direction requests, website clicks, bookings, how often it was shown on Google Search and Maps, and the search terms that showed it, as Google aggregates them); read the listing's own details (categories, hours, services, attributes, description, verification state and booking links); and count the practice's own posts and photos, with their types and dates.

This data is used only to show the practice its own reviews and results inside Captrix, and to alert the practice's team when a new review arrives. It is shown only to the practice's authorized owners and admins.
Captrix never replies to reviews, posts, or edits the practice's listings, and never links a review or a reviewer to a patient record.
Review text, reviewer names and the text of the practice's own posts are stored encrypted at rest, as is the OAuth refresh token. Captrix also stores the daily performance figures, monthly search terms and listing details above. Reviews are refreshed hourly. Every stored item is fetched again from Google within 30 days or deleted, and anything Google no longer shows is deleted from Captrix. Photos of the practice that customers upload are only counted; Captrix does not store them.
Google user data is never sold, never used to serve or target advertising, never used to train machine-learning models, and never shared with third parties except the service providers that host Captrix under confidentiality obligations.
A practice can disconnect at any time from Captrix Settings → Ad spend, which revokes Captrix's access at Google and deletes the token and everything Captrix read from the profile. A practice can also ask for this deletion by emailing jack@captrix.ai.

14.4 YouTube (YouTube API Services)

A practice can connect the YouTube channel it owns so Captrix can show the practice how its videos perform. This feature uses YouTube API Services. By connecting a YouTube channel, you agree to be bound by the YouTube Terms of Service. Google's handling of information is described in the Google Privacy Policy.

What we access. With your permission, Captrix requests two read-only scopes, youtube.readonly and yt-analytics.readonly. We read your channel's name, handle, subscriber count, total views and video count; the videos you uploaded, with each video's title, publish date, length, views, likes and number of comments; your playlists; and your channel's YouTube Analytics reports (views, engaged views, watch time, average view duration and percentage, subscribers gained and lost, likes and shares) by day and by video, including whether each is a Short, a video or a live stream, each video's audience retention curve, and aggregated breakdowns by traffic source, top search terms and referring sites, device and operating system, playback location, subscribed or not, country, US state and city area. We do not read your viewers' age or gender, your revenue, or caption text. We never read the text of comments, who commented, who subscribes, or any viewer's identity, and we never upload, edit, delete, comment or post anything on YouTube.
How we use and store it. We show this information only to the owners and administrators of your practice's Captrix account. We store this information so you can see your channel's history: your videos, their statistics and the Analytics reports above, for up to 36 months. Every stored item is read again from YouTube at least every 28 days, and a video's data is deleted as soon as YouTube no longer returns that video. Your Google authorization token is stored encrypted. We do not sell this information, use it for advertising, combine it with any other practice's data, or share it with anyone except the service providers who host Captrix. Some figures, such as how often you upload and which day your videos do best, are calculated by Captrix from YouTube's numbers and are labelled as such.
Revoking access and deletion. You can disconnect YouTube at any time in Captrix (Settings → Ad spend → YouTube → Disconnect); Captrix then revokes its access and deletes your YouTube data immediately. You can also revoke Captrix's access in your Google account's security settings at security.google.com/settings/security/permissions. Captrix deletes your stored YouTube data within 30 days of that revocation, and in practice within a day. Stored YouTube data not refreshed for 30 days is deleted automatically. To ask us to delete your YouTube data, or with any question or complaint, email jack@captrix.ai; we act on deletion requests within 7 days.

Captrix's use and transfer of information received from Google APIs, including Google Business Profile and YouTube, adheres to the Google API Services User Data Policy, including the Limited Use requirements.

14.5 LinkedIn

A practice can sign in with LinkedIn to let Captrix read three things it owns. From its LinkedIn Company Page (permissions r_organization_social and rw_organization_admin, used read-only): the Page's name, its posts and each post's counts of impressions, clicks, likes, comments, shares and video views and watch time, its daily follower gains and Page views, and LinkedIn's aggregated breakdowns of its followers and visitors (such as seniority, job function, industry, company size and location, with small groups combined). Captrix does not read the text of comments or who commented, reacted or follows. From its LinkedIn ad account (r_ads, r_ads_reporting): the account's name, status and currency, its campaign groups, campaigns and ads with their daily spend, impressions, clicks, conversions and lead-form opens, and LinkedIn's aggregated audience breakdowns. From its LinkedIn Lead Gen Forms (r_marketing_leadgen_automation): the answers a person submits on the practice's own form, which Captrix files as a lead in the practice's account, encrypted and access-audited, as the practice's business associate. Captrix never posts, comments or changes anything on LinkedIn and sends LinkedIn no lead, patient or conversion data. Captrix stores this data to show the practice its history, within LinkedIn's limits: statistics and ad results for up to one year and posts for up to six months; it is deleted on disconnect, and within 10 days if the LinkedIn sign-in stops working; filed leads are part of the practice's records and kept under its retention rules. LinkedIn sign-ins are stored encrypted and deleted on disconnect. To disconnect, use Captrix Settings → Ad spend → LinkedIn, remove Captrix at linkedin.com Settings → Data privacy → Permitted services, or email jack@captrix.ai.

14.6 TikTok

A practice can connect its own TikTok accounts. Each connection is started by an authorized practice user signing in with TikTok (OAuth 2.0); Captrix never sees the TikTok password.

TikTok ads and lead forms. With the practice's TikTok ad account connected through the TikTok API for Business, Captrix reads the account's name, status, currency and time zone, its daily spend, impressions and clicks per campaign, ad group and ad, and TikTok's aggregated audience breakdowns (such as age range, gender, country and placement), and receives the leads people submit to the practice's TikTok Instant Forms so they arrive in the practice's Captrix inbox. A lead is the practice's patient information from the moment Captrix receives it: it is encrypted, protected under HIPAA like every other lead, and never sent back to TikTok. Captrix never creates, edits or pauses ads, never sends TikTok any information about a lead, patient or booking, and uses no TikTok pixel or Events API.
The practice's own TikTok account. With the practice's TikTok account connected through TikTok Login Kit, Captrix reads the account's display name, follower, following, like and video counts, and for each of its videos the posting time, caption, link, duration and view, like, comment and share counts, to show the practice how its videos perform. Captrix does not read comment text or messages and never posts.
TikTok data is shown only to the practice's authorized users, is not sold, not used for advertising or to train machine-learning models, and is shared only with our hosting providers under confidentiality. Tokens are stored encrypted. Captrix stores these figures so the practice can see its history: ad results for up to 24 months, and a daily snapshot of the account's and each video's counts while the account is connected. Disconnecting a TikTok account in Captrix Settings → Ad spend deletes its tokens, asks TikTok to revoke them and deletes everything Captrix read from it; if the sign-in stops working, the data is deleted within 30 days. Deletion can also be requested at jack@captrix.ai.

15. Accounting Integrations (QuickBooks)

A practice can connect its own QuickBooks Online company so that Captrix can send the practice's daily billing totals to its books. The connection is started by an authorized practice user, who signs in to Intuit and approves it on Intuit's own screen. Captrix never sees or stores the practice's QuickBooks password, and requests only Intuit's accounting scope (com.intuit.quickbooks.accounting).

What Captrix sends to QuickBooks. Day totals per account: for example, the money collected by card on a given day and the income it belongs to, as journal entries or deposits the practice chooses. These entries never contain patient names, dates of birth, contact details, diagnoses, procedures performed on a named person, or any other protected health information. A practice that keeps receivables in QuickBooks sees one generic customer created by Captrix ("Patients (Captrix)") in place of individual patients.

What Captrix reads from QuickBooks. The practice's chart of accounts, classes and locations (so the practice can choose where each total goes), its company name, home currency and tracking preferences, its list of products and services (only when the practice chooses to import them as proposed billing codes), and the entries Captrix itself created (to confirm they still match what was sent). Apart from looking up the one customer it creates, Captrix does not read the practice's customers, vendors, invoices, bills, bank transactions or reports.

Captrix never edits or deletes anything in QuickBooks it did not create, and never deletes its own entries. Corrections are posted as new, dated entries, unless the practice chooses to have Captrix update its own earlier entry instead.
OAuth access and refresh tokens are encrypted at rest and used only to perform the actions above.
A practice can disconnect at any time from Captrix Settings → Accounting, or from its QuickBooks account. Disconnecting in Captrix revokes Captrix's access at Intuit and deletes the stored tokens immediately.
After disconnecting, Captrix keeps its own record of which entries it sent (dates, accounts and totals) and the practice's account choices, so the practice can see what its books were told and reconnect without starting over. A practice can ask us to delete this record at any time.
Data from QuickBooks is never sold, never used to train machine-learning models, and never shared with advertising or analytics partners.

QuickBooks and Intuit are trademarks of Intuit Inc. Captrix is not affiliated with or endorsed by Intuit.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. Continued use of our services after changes constitutes acceptance of the updated policy.

17. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Timber Health, Inc.
c/o Legalinc Corporate Services Inc. (Registered Agent)
131 Continental Dr, Suite 305, Newark, DE 19713
Email: jack@captrix.ai
Web: https://captrix.ai