Effective date: 2026-07-04
PracticeLien ("we", "us", or "our") is a multi-tenant software-as-a-service platform built for personal-injury and motor vehicle accident (MVA) medical practices. We take your privacy and the privacy of your patients seriously. This Privacy Policy describes how we collect, use, disclose, and protect information when you use the PracticeLien platform.
We process the following categories of data on behalf of our customers (medical practices):
Practice Operational Data: Appointment records, case information, lien balances, billing records, referral information, and attorney correspondence — imported from DrChrono or entered directly into PracticeLien.
Protected Health Information (PHI): Patient names, dates of birth, contact information, diagnosis codes, treatment records, and insurance information, to the extent provided by the practice through the DrChrono integration. PracticeLien acts as a Business Associate under HIPAA with respect to PHI.
Account and Authentication Data: Staff names, email addresses, role assignments, and Clerk authentication credentials.
Usage Data: Application logs, feature-usage telemetry, and error reports — all stripped of PHI before transmission to third-party observability tools.
We engage the following sub-processors to deliver the platform. Each is bound by a data processing agreement (DPA) and, where applicable, a Business Associate Agreement (BAA): Microsoft Azure (compute, database, storage), Clerk (authentication), Stripe (billing — no PHI in metadata), Resend (transactional email), Sentry (error monitoring, PHI scrubbed), and DocuSeal (e-signatures, BAA review in progress). For the complete sub-processor list with change notifications, visit practicelien.com/legal/subprocessors.
PracticeLien is designed for HIPAA-covered entities. If your practice qualifies as a Covered Entity under HIPAA, PracticeLien will execute a Business Associate Agreement (BAA) with you before any PHI is processed in production.
Key HIPAA commitments: PHI is stored only in Azure SQL Database, reachable solely over a private endpoint with no public network access, in the Azure centralus region (United States). PHI is never placed in URLs, error messages, log lines, Stripe metadata, or third-party telemetry payloads. PHI access is audit-logged at the row level (read, modify, export, release events). Encryption at rest and in transit is enforced on all storage layers. Access is restricted by role-based access control (Clerk org roles) scoped per practice tenant.
We retain practice data for the duration of the subscription plus a 90-day wind-down period. Following contract termination, practice data (including PHI) is deleted from active systems within 30 days and from backups within 90 days, unless a longer retention period is required by applicable law.
Audit logs (access records, without PHI payload) are retained for 6 years to satisfy HIPAA §164.530(j).
Depending on your jurisdiction, you may have rights to access, correct, or request deletion of personal data we hold about you. Patients exercising rights with respect to PHI should contact their medical provider directly. Practice staff may submit requests to legal@practicelien.com.
For privacy inquiries, BAA requests, or data deletion requests, contact us at legal@practicelien.com or by mail at: PracticeLien / Seven Seas LLC, [Registered address — LAWYER-REVIEW-PENDING], United States. We will respond to all valid requests within 30 days.