Privacy Policy

1. Introduction

This Privacy Policy describes how Light-it Inc. (“Light-it,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information through the ChatGPT Clinician website, registration and login flows, forms, cookies, analytics tools, marketing communications, and support channels.

It applies to chatgptclinician.com and related webpages, contact forms, registration and trial flows, login pages, marketing communications, newsletters, and website support channels. Customer Content submitted within the CompliantChatGPT platform, including prompts, files, audio, dictated summaries, transcripts, clinical notes, and outputs and Protected Health Information (“PHI”), is governed by our Terms of Service and, where applicable, a Business Associate Agreement (“BAA”).

2. Who We Are

ChatGPT Clinician is a CompliantChatGPT experience provided by Light-it Inc. It offers AI-powered tools that support clinical and operational drafting, summarization, document review, and related healthcare workflows. For privacy questions or requests, email legal@lightit.io.

3. Information We Collect

We collect personal information when you interact with our website, submit a form, create an account, start a trial, log in, contact us, subscribe to communications, or interact with our marketing and support tools.

4. Information You Provide Directly

We may collect:

• Name and email address;
• Company, clinic, or organization name;
• Role or job title;
• Registration and account information;
• Information submitted through contact, support, or chat channels;
• Newsletter and marketing preferences;
• Billing information such as the name and email associated with a transaction; and
• Any other information you choose to provide.

Registration, trial, login, and app access

Account flows may collect identifiers, registration date, authentication method, plan or subscription interest, and related account information. Sign-up or login may be available through email and password, Google Sign-In, Apple Sign-In, or SSO where offered.

Clinical content

Authorized Users may submit prompts, files, audio, dictated summaries, transcripts, clinical notes, and outputs, which may include PHI. This Customer Content is governed by our Terms of Service and any applicable BAA, and is not used for marketing, advertising, or AI model training.

Website, device, and usage information

We and our service providers may automatically collect IP address, browser and device information, operating system, referring URLs, pages viewed, links clicked, timestamps, cookie or pixel identifiers, approximate location derived from IP address, and similar technical or usage information.

Communications and support

If you contact us, we may collect contact information, message content, support details, chat history, troubleshooting information, and attachments or screenshots you provide. We use Intercom for website chat and support functionality.

5. Cookies, Pixels, Analytics, and Similar Technologies

We and our service providers use cookies, pixels, tags, scripts, and similar technologies to operate the website, understand usage, improve performance, provide support, prevent abuse, measure marketing performance, and conduct marketing activities.

These tools may include Google Analytics, Google Tag Manager, HubSpot, Meta Pixel, reCAPTCHA, and Intercom. Google tools support analytics and measurement; HubSpot supports newsletters and campaigns; Meta Pixel supports campaign measurement and optimization; reCAPTCHA helps prevent spam and abuse; and Intercom supports chat and support.

Advertising and analytics tools are used only on public websites and marketing pages. They do not access Customer Content, including prompts, files, audio, dictated summaries, transcripts, clinical notes, and outputs or PHI. Customer Content is not used to train, develop, or improve our or any third party’s AI models. AI providers are engaged under terms that exclude Customer Content from model training. We do not sell personal information. Browser settings may allow you to control cookies, although disabling them can affect functionality.

6. How We Use Personal Information

We may use personal information to:

• Operate, maintain, secure, and improve the website and platform;
• Process registrations, trial, login, account, and access requests;
• Respond to inquiries and provide support;
• Send newsletters, product updates, and marketing communications;
• Analyze traffic and measure website and campaign performance;
• Run, measure, and optimize advertising campaigns;
• Create aggregated or de-identified information for reporting and business purposes;
• Protect against spam, abuse, fraud, and security risks;
• Comply with legal obligations and enforce agreements; and
• Protect our rights, users, customers, and services.

7. Marketing Communications

We may use information from registrations, contact forms, and website interactions to send newsletters, product updates, and promotional emails. You can opt out using the unsubscribe link or by contacting legal@lightit.io. We may still send transactional, administrative, security, legal, or service messages.

Marketing uses account-level or website interaction information such as name, email, organization, registration information, and product interest. We do not use PHI or Customer Content to create, target, or personalize marketing.

8. How We Disclose Personal Information

Service providers

We may disclose information to providers that operate our website, registrations, authentication, support, analytics, email campaigns, abuse prevention, payments, and business operations. These may include Google Analytics, Google Tag Manager, HubSpot, Meta Pixel, reCAPTCHA, Intercom, Google Sign-In, and Apple Sign-In where used. Stripe, Inc. processes payment card data directly; Light-it does not store payment card data. Stripe’s processing is governed by its own privacy policy.

AI and, where enabled, speech-to-text providers process Customer Content solely to provide the service, under applicable contractual safeguards and BAAs. They are prohibited from using it for their own purposes, including model training.

Marketing and advertising partners

We may disclose public-website activity, cookies, pixels, and similar online identifiers to analytics, marketing, and advertising partners, including Meta. Depending on applicable law, this may be considered targeted advertising. These disclosures do not include Customer Content or PHI.

Aggregate or de-identified information

We may use or disclose aggregated or de-identified information that cannot reasonably identify an individual.

Legal, compliance, and business transfers

We may disclose information to comply with law or legal process, cooperate with authorities, enforce agreements, protect rights and safety, or investigate fraud and security incidents. Information may also be transferred in connection with a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or similar transaction.

We do not sell personal information to third parties.

9. Retention

We retain personal information for as long as reasonably necessary to operate the website, manage accounts, provide support, send permitted communications, maintain security, comply with law, resolve disputes, and enforce agreements. Periods vary by information type, collection purpose, legal requirements, and business need.

If you unsubscribe or request deletion, we process the request according to applicable law and our obligations. Retention of Customer Content is governed by our Terms of Service and any applicable BAA.

10. Your Choices and Privacy Rights

Depending on your location and applicable law, you may have rights to access, correct, delete, or obtain a copy of personal information, or object to or opt out of certain uses. To exercise a right, email legal@lightit.io. We may verify your identity, and some requests may be limited by law, security requirements, or legal obligations.

11. Security

We use commercially reasonable administrative, technical, and organizational safeguards designed to protect personal information. CompliantChatGPT’s published security materials describe AES-256 encryption at rest, TLS encryption in transit, access controls, audit logs, and applicable BAAs. No website, system, network, or storage method is completely secure, and we cannot guarantee absolute security.

12. International Processing

We may process and store personal information in the United States and other countries where we or our service providers operate. If you access the website from outside the United States, your information may be processed in countries with different privacy laws.

13. Children’s Privacy

Our website and services are not directed to children or minors, and we do not knowingly collect personal information directly from children. If we learn that information was collected from a child in violation of applicable law, we will take appropriate steps to delete it.

14. Notice at Collection

At or before collection, we may provide additional notices describing the categories collected, purposes, and applicable rights. This policy is the general notice for our website, registration, login, support, and marketing practices. Additional notices may appear in forms or account flows.

15. Third-Party Websites and Services

Our website may link to third-party websites, applications, login providers, or services. We are not responsible for their privacy practices, and their own terms and policies may apply.

16. Changes to this Privacy Policy

We may update this policy from time to time and will revise the “Last updated” date above. For material changes, we may provide notice through the website, email, or another appropriate method.

17. Contact Us

For questions, requests, or concerns about this policy or our privacy practices, contact: