Use limited to the service
Protected health information is used solely to provide the contracted service, as the agreement permits or the law requires. Never for our own purposes, never sold, never used to train models for third parties.
Legal
Business Associate Agreement
Last updated August 2026. This page is an overview of our standard business associate terms. The executed agreement governs; this page creates no obligations on its own.
Executed before data flows
When Attergo processes protected health information on your behalf, it does so as your business associate under a signed business associate agreement, executed before any patient information reaches the platform. Request the current form for counsel review at privacy@attergo.com.
Roles
You are the covered entity: the patient record and the patient relationship are yours. Promatics Technologies Inc. is the business associate, processing what you direct, for the purposes you specify, and for no other reason.
What the agreement commits us to
Safeguards, implemented
Encryption in transit and at rest, database-enforced tenant isolation, least-privilege access, and a redactor that keeps protected health information out of logs by construction.
Append-only access records
Access to patient information is recorded to a log that cannot be edited after the fact. Who saw what, and when, is always answerable.
Subcontractors bound equivalently
Any subcontractor with potential exposure to protected health information is bound by terms at least as protective as ours, and identified to you.
Breach notification on contract timelines
Discovery of a breach of unsecured protected health information triggers notification within the timeframes your agreement and the law require, with the facts and the remediation underway.
Support for individual rights
You are the covered entity and control the record. We support access, amendment and accounting-of-disclosure requests within the timeframes that bind you.
Return or destruction on termination
A complete export, including the raw event archive, precedes any deletion. Where law requires continued retention, protection continues for as long as we hold the data.
Ten-year evidence retention
The raw event archive is retained for a minimum of ten years. It is the record that answers an audit or a records request years after a fill, and it is why a response takes minutes rather than weeks. Retention terms are set in your agreement.
Scope of this page
A plain-language summary for diligence. It is not legal advice and it is not the executable agreement; where it differs from the signed agreement, the signed agreement governs.
Related
The privacy policy covers information handling generally; the security page covers the technical controls behind these commitments.