Sigmatic Privacy Policy
Effective date:10-13-26 Last updated: 10-13-26 Revised October 12, 2026
Sigmatic.ai Corporation (“Sigmatic”, “we”, “us”) builds an operating platform for surgery centers and other healthcare organizations. This Privacy Policy explains how we collect, use, share and protect information through our website, sigmatic.ai, and our platform, including the web application, APIs and integrations (the “Services”).
1. Who this policy covers and our role
Website visitors and business contacts. When you visit our website, request a demo, or contact us, Sigmatic decides how your information is used. We are the controller of that information.
Customer Data in the Services. Our customers are organizations. When a customer uses the Services, the data it provides or connects (“Customer Data”) belongs to the customer. We process it on the customer’s behalf and under its instructions, as a processor (or “service provider”). Where Customer Data includes protected health information (“PHI”), we act as the customer’s business associate under HIPAA and a Business Associate Agreement governs that PHI.
If you are a patient or employee of one of our customers and have questions about your information, contact that organization first. We will help them respond.
Our Terms of Service and any signed agreement with a customer also govern how we handle Customer Data. If a signed agreement conflicts with this policy, the signed agreement controls.
2. Information we collect
Information you give us. Name, work email, phone number, job title and organization when you fill in a contact or demo form, create an account, or contact support. Billing contact details for customers.
Information from other sources. We may receive business contact information from publicly available sources, event organizers or referral partners for sales and marketing purposes.
Account and usage information. Login details, user roles and settings, and how users interact with the Services, such as pages viewed, features used, IP address, browser and device type, and error logs.
Data from connected systems. With a customer administrator’s authorization, the Services connect to the customer’s own systems and import data from them. The data depends on what the customer connects:
Connected system
Examples of data we import
Accounting, such as QuickBooks Online
Company profile, chart of accounts, invoices, bills, payments, vendors, customers, items and financial reports
EHR and practice management
Case schedules, procedures, providers and patient information, which may include PHI
Supply chain and inventory
Items, purchase orders, usage and cost data
IoT, cameras and ambient sensors
Room status, equipment and environmental readings, and video or sensor events
We access these systems only with the permissions the customer grants, for example through Intuit’s OAuth sign-in for QuickBooks. We do not receive or store the customer’s QuickBooks password. A customer can disconnect a system at any time from the Services or from the third-party provider’s settings, and we then stop importing data from it.
AI inputs and outputs. Prompts, questions and data submitted to our AI features, and the reports, summaries and recommendations they produce. These are Customer Data.
Biometric information. We do not use facial recognition, voiceprints or other biometric identifiers to identify individuals, and we do not collect biometric identifiers for our own purposes. If a customer configures a feature that could identify individuals from video or audio, the customer is responsible for the notices and consents required by applicable biometric privacy laws.
3. How we use information
Customer Data, including data from connected systems such as QuickBooks, is used only to provide the Services to that customer: to build its reports and dashboards, run the automations it sets up, generate AI outputs, provide support it requests, and keep the Services secure. We do not sell Customer Data, use it for advertising, or combine one customer’s data with another’s.
Website and account information is used to respond to inquiries and demo requests, manage accounts and billing, send service and security notices, send product updates (you can opt out of marketing emails at any time), prevent fraud and misuse, and meet legal obligations.
Usage data and aggregated statistics. We collect technical usage data about how the Services are accessed and used, and we may create de-identified, aggregated statistics about how the Services perform and are used. These do not identify any customer, user or patient, and we may use them to operate, secure, analyze and improve the Services.
4. AI and model training
We do not use Customer Data, including financial data from QuickBooks or PHI, to train, retrain, tune or otherwise improve AI models. The only exceptions are (a) AI inputs and outputs that are free of personal information, de-identified under the HIPAA standard, and aggregated and anonymized, and (b) improvements that naturally occur from operating the Services for a customer, as described in our customer agreements. Our AI features run on third-party foundation models hosted within our cloud environment in the United States. Those providers process data only to return results to us and are contractually barred from using it to train their models. They are listed on our subprocessor page.
5. Protected health information
PHI is handled under HIPAA and each customer’s Business Associate Agreement. We use and disclose PHI only as that agreement permits, apply HIPAA safeguards, and notify the customer of any breach as HIPAA and the agreement require.
6. How we share information
We share information only as follows:
Service providers (subprocessors) that host, secure, operate and support the Services. They act on our instructions under written contracts and, where they handle PHI, business associate agreements. Our current subprocessors are: Amazon Web Services (cloud hosting and AI model inference, United States); Stripe (payment processing); Microsoft 365. We maintain the current list of subprocessors and update it when we add or replace a subprocessor; customers with a signed agreement may request latest list of subprocessors.
At the customer’s direction, for example when a customer connects or sends data to another system.
Legal and safety reasons, when required by law, court order or regulators, or to protect the rights and safety of Sigmatic, our customers or others. Where permitted, we will notify the affected customer before disclosing its Customer Data.
Business transfers, to a successor in a merger, acquisition or sale of assets, subject to this policy and customer agreements.
We do not sell personal information, and we do not share it for cross-context behavioral or targeted advertising.
7. Retention and deletion
We keep Customer Data for as long as the customer’s subscription is active. After a subscription ends, Customer Data remains available to the customer for 30 days, then we delete or anonymize it unless otherwise instructed by customer. We may keep de-identified data and backup or archival copies required by law or kept for disaster recovery or audit, and these remain protected under this policy. When a customer disconnects a system such as QuickBooks, we stop importing new data from it. A customer can ask us to delete data already imported by contacting us, and we will do so within 30 business days unless the law requires us to keep it.
Website and business contact information is kept for as long as needed for the purpose it was collected, or as required by law.
8. Security
We use administrative, technical and physical safeguards appropriate to the sensitivity of the data, including encryption in transit and at rest, role-based access controls, multi-factor authentication for our personnel, and logging and monitoring. Our security program is aligned with the SOC 2 Trust Services Criteria. Sigmatic holds a current SOC 2 report. Our controls are independently audited under SOC 2 Type II. No system is completely secure. If a security incident affects your information, we will notify affected customers, individuals and authorities as required by law and our agreements.
9. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, to opt out of targeted advertising, sale or profiling (we do none of these), and to withdraw consent. To make a request, email info@sigmatic.ai with “Privacy Request” in the subject line. We will verify your identity before acting and respond within 45 days, which we may extend once by a further 45 days where reasonably necessary, with notice to you.
U.S. state privacy rights and appeals. Residents of Texas and other states with comprehensive privacy laws may exercise the rights above. If we decline to act on your request, you may appeal by replying to our decision within 60 days. We will respond to your appeal in writing within 45 days, explaining our decision, and, if we deny the appeal, how you may contact your state attorney general. We do not discriminate against you for exercising your rights. You may use an authorized agent to submit a request if the agent provides proof of your authorization.
If your request concerns Customer Data, such as information held by a center that uses Sigmatic, we will refer it to that customer and help them respond. The customer, not Sigmatic, decides how to respond to requests about Customer Data.
10. Cookies
Our website uses cookies and similar technologies to keep the site working, remember preferences and understand how visitors use it. Where required, we ask for consent before setting non-essential cookies, and you can change your choices at any time through our cookie banner or your browser settings. Some features may not work if cookies are disabled. We do not use cookies for cross-site advertising.
11. Where data is stored
The Services are hosted in the United States, and Customer Data is processed and stored in the United States. If you access our website from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.
12. Children
The Services are for businesses and are not directed to children. We do not knowingly collect personal information from children through our website or for our own purposes. Patient information about minors may be included in Customer Data, and it is handled under the customer’s instructions and HIPAA.
13. Changes to this policy
We may update this policy and will post the new version at https://sigmatic.ai/privacy with a new effective date. For material changes, we will notify customer administrators by email or in the app at least 30 days before the change takes effect.
14. Contact us
Questions or requests about this policy or your personal information: Sigmatic.ai Corporation, 1205 BMC Drive, Suite 708, Mailbox 8, Cedar Park, TX 78613. Email: info@sigmatic.ai.