StillThought Privacy Policy

Effective date: October 10, 2026.

StillThought provides software that helps healthcare practices organize clinical information, communications and care workflows. This policy explains how StillThought handles personal information through its website and services, including connected Google accounts.

When a healthcare practice uses StillThought, we process its patient information under the practice's instructions and applicable service agreements, including a Business Associate Agreement where required. The practice remains responsible for its clinical records and its own privacy notices. This policy does not replace your healthcare provider's Notice of Privacy Practices or change an existing customer agreement.

Information we handle

Depending on the features you use and the practice's configuration, we handle:

• Account information: names, email addresses, authentication identifiers, practice affiliations and access roles. Google sign-in can provide basic profile information. An optional account-linking flow may verify additional email addresses associated with your Google account.
• Practice and patient information: information that authorized users enter, upload or connect, such as clinical records, assessments, appointments, messages and documentation. Recording or transcription features require the practice to obtain appropriate permissions.
• Connected account information: Google account identity, authorization tokens, email information and calendar information described below. Connecting Gmail or Calendar is separate from using Google to sign in.
• Service information: technical and security information needed to operate the service, such as request times, device or browser information, IP addresses and access or error records. Communications with support may also contain personal information.

Signing in with Google does not by itself grant access to a practice's records or connect your mailbox. Practice membership and role permissions determine access to clinical information.

Gmail and Google Calendar

When an authorized user connects Gmail, StillThought can read message information, including sender and recipient information, subject, message text, message and thread identifiers, and labels. Its requested Gmail permission also supports sending messages and changing labels or read status. Enabled workflows can organize communications, route messages to the appropriate practice workflow, assist with scheduling and send authorized replies or notifications.

Google's mailbox permission can cover messages beyond those ultimately linked to a patient or workflow. Practice routing and filtering settings determine how messages are processed; they do not narrow the permission granted by Google. Connect only a mailbox you are authorized to use for these purposes.

Calendar access is optional and requires additional authorization. StillThought can list calendars, read availability and events, and create, update or remove appointments associated with StillThought in the selected calendar. For unrelated calendar events, availability workflows use busy intervals rather than importing private event descriptions and attendees into clinical records. Appointment details written to Google Calendar can be visible to others who have access to that calendar. Choose calendar sharing settings appropriate for the information being synchronized.

We store authorization credentials in access-controlled service infrastructure so that enabled background workflows can continue without repeated sign-in. We do not publish credentials or make them available to other customers.

AI assistance

Enabled features may send Gmail or calendar information to AI services to classify or summarize communications or assist with scheduling. For this information, StillThought permits AI processing only within its approved Google Cloud environment, using services and controls covered by the applicable HIPAA agreements when protected health information is involved.

StillThought does not use Gmail or calendar data, or information derived from it, to train or fine-tune AI models, and does not authorize AI providers to do so. Processing a request to generate an answer is different from training a model. Processing and retention are governed by the selected service's configuration and applicable agreements; this policy does not promise that every AI request has zero retention.

AI output can be incomplete or incorrect. Authorized users remain responsible for reviewing it before relying on it for care or communications.

How we use and share information

We use information to provide the features you and your practice enable, authenticate users, enforce access permissions, maintain security and reliability, provide support, and meet applicable legal obligations.

Information may be shared with authorized members of your practice and with service providers needed to deliver enabled features, such as cloud hosting or approved AI processing. Transfers of Google account data are limited to purposes permitted by Google's policies, including consented features, security and legal requirements. Other connected services receive information only as required for their authorized workflows. Your practice is responsible for deciding which integrations it enables and who may access its records.

We do not sell Google account data, use it for advertising, transfer it to data brokers or use it to assess creditworthiness. StillThought personnel do not read Google account content except where permitted for a specific purpose with your affirmative agreement, security investigation, legal compliance, or Google's other narrowly permitted exceptions. Ordinary access by the practice's authorized users supports the features you consented to use.

Our handling of Google API data, including permitted transfers, follows the Google API Services User Data Policy, including its Limited Use requirements, and the Google Workspace user data and developer policy.

Security and retention

We use safeguards appropriate to the service, including restricted access, protected transmission, secure credential storage and access controls. No system can guarantee complete security. Do not send passwords, access tokens or patient records to our general support email.

We retain information only for the applicable service purpose, customer instructions, legal obligations and permitted security or recovery needs. Imported information that becomes part of a practice record follows the practice's applicable record requirements and our agreements, subject to Google API policies for information obtained through those APIs. Credentials, transient processing data and clinical records may have different retention requirements.

Deletion requests include consideration of active copies, backups and service-provider copies, as applicable. Information required by law or needed for a permitted legal purpose may need to be retained with restricted access. We will explain applicable limitations when responding to a deletion request.

Your choices and requests

You can revoke StillThought's Google account access through your Google account connections settings. This stops future authorized Google access and can interrupt connected workflows. You can also ask your practice administrator to disable a connected workflow. Disabling Calendar synchronization alone does not necessarily revoke a combined Google authorization or delete appointments already written to Google.

Revoking access does not automatically erase information already imported into practice records. To request removal of imported Google data or connected-account credentials, contact your practice administrator or StillThought at michael@stillthought.health. We will verify the request and coordinate with the practice where necessary. For access, correction or deletion of a patient medical record, contact the practice responsible for that record. Applicable law and the practice's record obligations determine available rights.

Our services use browser storage or cookies where needed for sign-in, sessions and user preferences. Browser controls can restrict these, but doing so may prevent features from working. Contact us with questions about browser storage or website tracking.

Patient access, including access involving children or authorized representatives, is managed by the responsible practice. The public website is not intended for children to independently submit medical information.

Changes and contact

We will update the effective date when this policy changes and provide additional notice or obtain renewed consent when required for a material change in how information is used.

For privacy questions or requests, contact StillThought at michael@stillthought.health.