MySpark+ Privacy Policy

LitBiz Media, LLC ("LitBiz Media," "we," "our," or "us") operates the MySpark+ platform and the website at mysparkplus.app. This Privacy Policy explains how we collect, use, disclose, and safeguard information. It covers three situations: visitors to this website, customers who use the MySpark+ platform, and patients whose information is managed in the platform by their healthcare provider.

1. Website visitors

We collect information you voluntarily submit, such as your name, email address, phone number, and business information when you contact us or request information. We use it to respond to inquiries, provide and market our services, and communicate with you. We do not sell or rent personal information.

Analytics and tracking: the mysparkplus.app marketing site currently uses no third party analytics or advertising trackers, no Google Analytics, and no advertising pixels. If that changes, this policy will be updated first. The website loads fonts from Google Fonts, which involves your browser requesting files from Google's servers.

Cookies: the marketing pages do not set tracking cookies. The MySpark+ application uses essential session cookies strictly to keep you signed in.

2. Platform customers

When a clinic creates a MySpark+ account, we collect account information (names, email addresses, phone numbers of staff users), billing information, and records of how the service is used. We use this to provide and improve the service, process subscription payments, provide support, and send service communications.

Subscription payments are processed by our payment processor; full card numbers are held by the processor, not by us.

3. Patient information (data we process for clinics)

Healthcare providers use MySpark+ to manage patient records, appointments, communications, and payments. That patient information belongs to the clinic, not to us. We process it on the clinic's behalf, and where the clinic is a HIPAA covered entity on an eligible plan, we do so as a Business Associate under an executed Business Associate Agreement (BAA).

• We use patient information only to provide the service to the clinic: scheduling, reminders, communications, billing, and records the clinic maintains.
• We never sell patient information and never use it to market to patients.
• Patient data is encrypted in transit and at rest, access is role-restricted and logged, and our full security posture is described on the security page.
• If you are a patient and want to access, correct, or delete information a clinic holds about you, contact your clinic directly. They control your records, and MySpark+ supports them in fulfilling such requests, including complete record exports.

SMS communications

If you opt in to receive SMS from MySpark+ or from a clinic using the platform: message frequency varies, message and data rates may apply, and you can opt out at any time by replying STOP or get help by replying HELP. Opt-outs are honored automatically and permanently by the platform. Mobile phone numbers are never sold or shared with third parties for marketing.

Service providers

We use a small set of infrastructure providers to run the service, each receiving only what is necessary: Amazon Web Services (hosting and storage), Twilio (SMS and voice delivery), Mailgun (email delivery), and Square or Authorize.net (payment processing). Providers handling protected health information on our behalf are engaged under appropriate agreements.

Data security

We implement administrative, technical, and physical safeguards designed to protect information, including encryption in transit and at rest, role-based access controls, audit logging, two-factor authentication for administrators, and tested backups. No method of transmission or storage is completely secure, and no absolute guarantee can be made.

Data retention

We retain information for as long as needed to provide the service and meet legal obligations. Clinical and financial records follow healthcare retention norms while an account is active. Following account closure, customer data is deleted in accordance with our retention practices and the BAA where one is in place.

Your privacy rights

Depending on your jurisdiction, you may have rights to access, correct, or delete your personal information, and to opt out of marketing communications. Requests may be submitted to hello@litbiz.io. California residents may request disclosure or deletion of personal information collected about them; we do not sell personal information. If you are a patient, direct requests to your clinic as described above.

International users

If you access the website or platform from outside the United States, your information may be transferred to and processed in the United States.

Children's privacy

Our website and services are not directed at children under 13, and we do not knowingly collect information from minors, except patient records a healthcare provider maintains for its own patients under applicable law.

Changes to this policy

We may update this Privacy Policy periodically. Updated versions will appear on this page with a revised date.

Contact

LitBiz Media, LLC
hello@litbiz.io
(317) 689-0766