Privacy Policy
Last updated: October 14, 2026
This Privacy Policy explains what personal information Genkō Prior Auth (“the Service”, run by Genkō) collects, why, who receives it and what choices you have. The Service is in early access and for synthetic data only: it is not meant to receive real patient information, and this policy is written on that basis.
1. No real patient information (yet)
We have no business associate agreements (BAAs) with our infrastructure or AI providers and have not assessed the Service for HIPAA compliance, so it must not be used with real protected health information. Everything below describes how we handle the information of our users and visitors and the synthetic data they enter. If we later accept real PHI, we will update this policy and sign BAAs first.
2. What we collect
| Information | Source | Why |
|---|---|---|
| Name, work email, practice name, specialty and optional notes | The early-access form | To review your request, contact you and send your invitation |
| Email, name, role, sign-in events | Your account, created by invitation | To authenticate you and control access within your practice |
| Requests, clinical notes, documents and drafted packets (synthetic) | What your team enters | To provide the Service |
| Usage events, AI usage counts, audit log of actions (ids, not patient details) | Generated by the Service | Plan limits, security and accountability |
| Page views and basic device data | Vercel Web Analytics | To understand how the site is used |
| IP address and request logs | Our hosting and database providers | Security, abuse prevention and debugging |
3. How we use it
- Run the Service: sign you in, draft packets, enforce limits and keep each practice's data separate.
- Handle early-access requests: we email our team about each request and email you a confirmation. We email you about your invitation.
- Keep the Service secure, prevent abuse and fix problems.
- Understand usage in aggregate and improve the product.
- Meet legal obligations.
We do not sell personal information, and we do not use it for advertising.
4. AI processing
Packets are drafted by a third-party AI model reached through Vercel's AI Gateway. Before text leaves our servers, identifiers such as names, dates of birth, member IDs, contact details and addresses are replaced with placeholders, and the finished prompt is checked again; if an identifier remains, nothing is sent. Real values are put back only in your copy.
We do not store prompts or completions. We keep only the resulting draft you review, plus counts (such as tokens used) for limits. Details: Privacy and de-identification. De-identification is a safeguard, not a guarantee, which is why the Service is for synthetic data only.
5. Who receives information
We share information only with service providers that help us run the Service, under their own terms, and where the law requires:
| Provider | Purpose | Information |
|---|---|---|
| Vercel | Hosting, AI Gateway, Web Analytics | Requests, de-identified prompts, page views |
| Supabase | Database, authentication, file storage | Accounts and everything your practice stores |
| Resend | Transactional email | Early-access details and the email addresses we write to |
| AI model provider (via Vercel AI Gateway) | Drafting packets and appeals | De-identified text only |
We may also disclose information to comply with law or protect rights and safety, or in a merger or sale of the business (with notice). Our servers are in the United States; if you use the Service from elsewhere, your information is transferred there.
7. How long we keep it
Early-access requests are kept while we consider your request and for the life of the programme, and you can ask us to delete yours at any time. Account and practice data is kept while the practice is active; because early access uses synthetic data, we may reset it. Audit records are kept to support security and accountability. After you ask us to delete data we remove it within 30 days, apart from backups that roll off on their normal schedule and records we must keep by law.
8. Security
Data is isolated per practice in the database itself, traffic is encrypted in transit, access is by invitation with role-based permissions, and secrets stay on the server. No system is perfectly secure, and we cannot guarantee absolute security. Tell us promptly at privacy@getgenko.com if you suspect a problem.
9. Your choices and rights
You can ask us to access, correct or delete the personal information we hold about you, to stop emailing you, or to withdraw an early-access request. Write to privacy@getgenko.com; we will reply within 30 days. You can unsubscribe from non-essential email at any time.
California. If you live in California you have the right to know what personal information we collect, to delete it, to correct it, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising. Elsewhere (for example the EEA or UK), you may have similar rights, including to object to or restrict processing and to complain to your data protection authority. Where required, our legal bases are performing our agreement with you, our legitimate interest in running and securing the Service, and your consent.
10. Children
The Service is for healthcare professionals and is not directed to anyone under 18. We do not knowingly collect information from children.
11. Changes to this policy
We will update this policy as the product changes, particularly before we accept real patient information. For material changes we will give notice by email or in the Service ahead of time. The date at the top shows the latest version.
12. Contact
Privacy questions or requests: privacy@getgenko.com. See also our Terms of Service.