Prana procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “Responsibilities: Ensuring HIPAA and state privacy law compliance, investigating complaints, overseeing data protection training, conducting risk assessments” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “We will acknowledge receipt of your request within 5 business days and respond fully within 30 days (up to 60 days for complex requests).” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ File a Complaint With Prana Health: Send written complaint to privacy@pranadoc.com Include your name, contact information, dates, and description of the complaint” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ For EU, Swiss, and UK residents: Your health information is protected under applicable data protection laws (GDPR, UK GDPR). Contact privacy@pranadoc.com for jurisdiction-specific privacy terms.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ File a Complaint With State Attorneys General: Most states provide mechanisms for filing privacy complaints with the state's Attorney General. Contact your state's Attorney General office for procedures.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Upon expiration or termination of this Agreement for any reason, the receiving party will destroy (or at the request of the disclosing party, return) all copies of all Confidential Information of the disclosing party in its possession or under its control.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Records where the patient is deceased (retained per state law, typically 3-5 additional years)” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Important Note on Guest Data Persistence and Re-identification: While we describe guest interactions as "anonymous," we do collect technical identifiers (IP address, device type, location) that may allow re-identification of your session. Guest data is associated with a temporary session identifier. If you clear your browser cookies, close your session, or do not create an account, your history may not be recoverable. To retain your health information history and access additional features, you must create a Registered Member account. Guest chat logs and symptom data are retained for 7-30 days for service delivery and quality assurance. De-identified aggregate data may be retained indefinitely for AI model training.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ After 7 Years: Records may be destroyed after the minimum retention period, except: Records of patients under 18 at time of last encounter (retained until age 25)” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Medical Records: We retain clinical interaction records and medical information for a minimum of 7 years after your last encounter, as required by:” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Facilitate communication between you and our licensed healthcare providers Maintain continuity of care across our platform and traditional healthcare systems Service Level Expectation: We aim to connect you with a licensed physician as soon as possible. Response time varies based on case severity, complexity, and physician availability. If no provider is immediately available, your session data will be retained for coordination with an available provider, and you will be notified of the status. You may abandon your session at any time, and we will retain your session data for coordination with the next available provider unless you request deletion.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Legal Basis for Alerts: Automated alerts are generated as part of our core service offering and are provided to improve your health awareness and engagement with our platform. Alerts may also be used to measure user engagement and feature effectiveness (analytics purposes). You may opt out of automated health alerts at any time by adjusting your notification settings in the app or contacting privacy@pranadoc.com , though this may reduce the value of our continuous monitoring service. Data Retention for Alert Triggers: We retain data points that triggered alerts for a minimum of 7 years (consistent with medical record retention requirements) to support clinical documentation and quality improvement. We retain baseline wearable data for continuous analysis and AI improvement.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Medical records you authorize us to access from your EHR provider (via HIPAA-compliant EHR integrations such as Epic, Cerner, Athena, and other health information exchanges) Wearable device data (from Apple Health, Google Fit, Fitbit, Oura Ring, and similar health integrations) Genetic information (if you choose to share ancestry or genetic test results)” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Your Authorization Controls Sharing: You may authorize or revoke access to specific data sources in your Account Settings under "Manage Data Sharing." You may limit disclosure to specific providers or specific types of information (e.g., "share medical history but not mental health information"). EHR Integrations and Third-Party Providers: When you connect your electronic health records (EHR) from providers like Epic, Cerner, Athena, and other health information exchanges:” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We share relevant clinical information with your providers to facilitate care coordination” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Facilitate warm handoffs to urgent care or emergency services when medically appropriate Route your information to in-network providers (only with your explicit consent) Care Coordination: For Registered Members who request escalation to a human physician, we:” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Payment Processing: Stripe (payment processor) - receives only payment card information necessary for transactions; does not receive health information Communication and Customer Support: ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ HIPAA Business Associates: We share your information with third-party vendors who provide services on our behalf and are contractually bound to protect your privacy under HIPAA Business Associate Agreements (BAAs), including: Cloud Infrastructure: ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ You may disconnect third-party integrations at any time, which stops further data sharing and access Multi-System Revocation: If you disconnect an EHR integration, data sharing stops immediately for that provider system, but you may need to separately revoke access within each connected provider's system for complete deletion.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Your primary care physician (if you authorize and provide contact information)” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We explicitly do NOT share your information for:” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Affiliated Medical Groups: When you request escalation to a human physician or authorize treatment through our platform, we disclose your health information to: Licensed physicians and nurse practitioners affiliated with Prana Health” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ All Business Associates sign written agreements contractually obligating them to:” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Payment and Billing Information: Credit card or other payment method details (processed securely via our third-party payment processor, Stripe; we do not store full payment card information)” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Customer may connect, install or enable content or applications and software products that interoperate with the Services and are provided by a third-party or Customer, and not Prana AI ("Non-Prana AI Products"). Any acquisition and use by Customer of such Non-Prana AI Products is solely the responsibility of Customer and the applicable provider. Prana AI does not warrant or offer support for Non-Prana AI Products. To the extent Customer authorizes the access or transmission of Customer Data through a Non-Prana AI Product, Prana AI will not be responsible for any use, disclosure, modification or deletion of such Customer Data.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ You have the right to receive an accounting of disclosures—a list of who we have shared your information with and why—for the past six years. How to Request: Submit your request in writing to privacy@pranadoc.com with the subject line "Accounting of Disclosures Request." Response Time: Within 30 days (or 60 days if we need to generate the report). Limitations: The accounting does not need to include:” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We use third-party payment processors (e.g., Stripe) to handle billing and payment, subject to their terms and privacy policies. You authorize us and our payment processors to charge your designated payment method for all Fees owed, and we may store your payment information for recurring billing. If a payment fails, we may retry the charge, suspend your access to the Services, or terminate your Account after reasonable notice.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ All third-party vendors that access PHI are bound by HIPAA Business Associate Agreements (BAAs) that require them to use PHI only for specified purposes, maintain safeguards, report breaches immediately, and return or destroy PHI upon contract termination.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ You may cancel your subscription at any time through your Account settings or by contacting us. Cancellation will be effective at the end of the then-current billing period, and you will not receive a refund for any prepaid Fees.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ Prana Health's AI health assistant and informational Services are available to users in all 50 United States and the District of Columbia. Telehealth services provided through MD Integrations, LLC are available in the following jurisdictions, subject to applicable state regulations: Alabama, Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, District of Columbia, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, and Wyoming. Certain service limitations may apply in specific states. As noted in Section 15.2, if you reside in Illinois or Nevada, Prana AI is unable to provide information or respond to inquiries that raise mental, emotional, or behavioral health concerns. Availability of specific telehealth services may vary by state based on applicable regulations, and Prana AI reserves the right to modify the jurisdictions served at any time.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ The Services are provided on a Subscription basis. Your Subscription plan, Fees, payment terms, Subscription term, user limits, usage allowances, and other terms are determined by the Subscription term you select.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ We collect different categories of information depending on whether you use our services as a Guest User or Registered Member.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ Upon termination or expiration, your right to access and use the Services, any and all licenses granted by Prana AI hereunder, will immediately terminate, and any amounts owed to us as of the termination date will become immediately due and payable.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Fees for any Services which are not automatically included as part of a Subscription (including, for example and without limitation, fees for ad-hoc physician consultations, hardware or diagnostics) are due in advance of the use of any such Services. All Fees are stated in United States dollars unless otherwise specified and are exclusive of taxes, duties, and other governmental charges, which you are responsible for paying. If you are required to withhold taxes, you will increase the amount paid to us so that we receive the full Fee amount net of withholding. Fees are due and payable in advance for each billing period, typically monthly, unless otherwise agreed with us. Payment is due upon invoice or, for self-service Subscriptions, at the time of purchase or renewal via the payment method on file.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ If your use exceeds the limits of your subscription plan, such as the number of AI chat interactions, for example, we may charge overage fees or suspend your access until you upgrade your plan or reduce usage.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Prana AI's right to payment for the Services purchased by you shall accrue on the date the Services are initially delivered to you. Fees are non-refundable except as expressly provided in these Terms or required by law. If you cancel your subscription before the end of the Subscription Term, you will not receive a refund for Fees already paid, but you may continue to use the Services until the end of the then-current billing period.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ We may modify, update, enhance, or discontinue any aspect of the Services at any time, including features, functionality, integrations, or availability, with or without notice. We will use reasonable efforts to notify you in advance of material changes that adversely affect your use of the Services, but we are not liable for any such changes or for any inability to access or use the Services resulting from modifications, maintenance, or downtime.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ Your Subscription begins on the date you first access the Services or on which you agree to these Terms and continues for the initial Subscription term.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ Unless you cancel before the end of the Subscription term, your subscription will automatically renew for successive renewal terms of the same duration as the initial Subscription term, at the then-current Fees, unless either party provides written notice of non-renewal at least thirty days before the end of the then-current term.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ We reserve the right to modify our Fees and pricing upon at least thirty days' notice. Fee changes will take effect at the start of your next Subscription Term unless you cancel before the renewal date.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ To save your medical history, integrate wearable devices, connect electronic health records (EHRs), or escalate care to a human physician, you must create a secure Registered Member account. For Registered Members, we collect: Identity Information: ” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.