Privacy Policy

1. Who we are

This policy explains how GI Digital, Inc., 535 Fifth Avenue, 4th Floor, New York, NY 10017 ("GI Digital", "we", "us") handles personal information collected through this website, gi.digital. It also covers emails you send us in response to the website.

GI Digital provides workflow software, artificial intelligence (AI) tools, logistics, and support services for capsule endoscopy. GI Digital is not a medical provider. Consultations, medical decisions, test orders, study interpretation, and follow-up care are provided by independent, licensed partner clinicians.

2. Summary

We collect only what you choose to send us through a form or by email, plus basic technical data needed to run and protect the website. The website sets no cookies and uses no advertising or social-media tracking. We do not sell or rent personal information, and we do not use it for targeted advertising.

The patient eligibility check runs in your browser. Your answers are not sent to us unless you continue to the secure request form. Patient consultation requests are routed to a secure, HIPAA-compliant form in our Microsoft 365 environment and are shared only with the partner clinicians who serve your state.

3. What we collect and why

Provider, partner, investor and contact forms

If you request a demo, evidence materials, investor materials, or contact us, we collect what you enter, such as your name, role, organization, email, phone number, location, and message. We also record the page you sent it from, the time, and any campaign tags in the link that brought you to the website (for example, that you came from a LinkedIn post). We use this to answer your request and evaluate our communications. These forms are processed by Formspree, our form service provider. Please do not include health information about yourself or anyone else in these general forms.

Patient eligibility check

The check on the "For patients" page asks a few questions, such as your state, age range, and reason for interest. These answers are processed strictly within your browser. They are not sent to GI Digital or anyone else unless you choose to continue to the secure request form.

Patient consultation request

If partner clinicians are available in your state and you choose to continue, you will be directed to a secure intake form hosted in our HIPAA-compliant Microsoft 365 infrastructure. To save you time, your state selection is passed to that form in the web address. No medical reasons, health conditions, or personal details are transmitted in the web address.

The secure form asks for your name, contact details, state, reason for interest, and consent. We use this information solely to review your request and arrange a video consultation. We securely transmit these details to the partner clinician licensed in your state using encrypted communications. Once transferred, the clinician's practice is responsible for your medical care and data under their own Notice of Privacy Practices.

Waitlist

If partner clinicians are not yet available in your state, you can join a waitlist. We collect only your email address and state, and use them to tell you when the service becomes available. You can ask to be removed at any time.

Technical data

Our hosting provider, Cloudflare, processes technical data when you visit, such as your IP address, browser type, and the pages requested. This is used to deliver the website, keep it secure, and block abuse. We also use Cloudflare Web Analytics, which counts visits and pages in aggregate without cookies and without identifying you.

4. Cookies and tracking

The website does not set cookies. It does not use advertising pixels, social-media tracking tools, or session recording. If this changes, we will update this policy first and, where required, ask for your consent.

5. Who we share information with

• Service providers: infrastructure and software vendors who process data on our behalf under contracts that limit their use of it (Cloudflare for hosting and security, Formspree for the general forms, Microsoft for email and the secure patient form). Microsoft processes patient information under a Business Associate Agreement.
• Partner clinicians: licensed clinical practices serving your state, solely to fulfill patient consultation requests as described above.
• Professional advisers and authorities: external legal counsel, accountants, or regulatory and law enforcement bodies, strictly where required by law or to protect safety and legal rights.
• Successor organizations: a successor entity in the event of a corporate merger, acquisition, or sale of company assets.

We do not sell personal information and do not share it for targeted cross-context advertising.

6. Health information and consumer health data

GI Digital acts as a technology provider and Management Services Organization (MSO). When we collect and process patient consultation requests on behalf of Partner Practices, we do so securely as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA).

State consumer health data laws (Washington, Nevada, Connecticut): for consumers residing in states with specific consumer health data privacy laws (including Washington's My Health My Data Act and Nevada SB 370), any health-related information you provide prior to establishing a formal clinical relationship is collected and used strictly to fulfill your requested service (connecting you with a healthcare provider). It is never sold, shared for cross-context behavioral advertising, or used for any secondary commercial purpose.

7. How long we keep information

• Business inquiries: retained for the duration of any resulting commercial relationship, plus up to three (3) years.
• Waitlist entries: retained until the service becomes available in your state and you are notified, or until you request removal.
• Patient consultation requests: transmitted to the assigned Partner Practice, and retained in our HIPAA-compliant storage environment for up to seven (7) years to comply with statutory medical record and audit retention rules.
• Technical and security logs: retained for up to 180 days pursuant to standard Cloudflare security policies.

8. Security

The website is served over encrypted connections (HTTPS). Access to consultation submissions is strictly limited to authorized personnel using two-factor authentication within our secure Microsoft 365 environment. No system is completely secure; please use the secure request form, not ordinary email, for any health-related inquiries.

9. Your choices and rights

You can ask us at any time to access, correct, or delete the personal information we hold about you, or to stop sending you communications. Every email we send includes an opt-out mechanism. Contact us using the details in section 13; we will respond within 45 days. We will not discriminate against you for exercising your privacy rights.

10. Children

This website and our services are intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has sent us information, please contact us and we will delete it.

11. Visitors outside the United States (GDPR and UK GDPR)

GI Digital is based in the United States. If you visit our website or contact us from the European Economic Area (EEA) or the United Kingdom, your information will be transferred to and processed in the United States.

• Legal basis: we process business inquiries on the basis of our legitimate interest in responding to your requests and managing commercial relationships. We process health or patient inquiries on the basis of your explicit consent and for healthcare coordination.
• Data transfers: where applicable, data transfers are safeguarded by Standard Contractual Clauses (SCCs) executed with our infrastructure providers. You have the right to request access, rectification, erasure, or restriction of your data, or to lodge a complaint with your local supervisory authority.

12. Links to other websites and changes to this policy

The website links to external sites, such as research publications and partner websites. Their own privacy policies apply on those sites. We may update this policy; the date at the top indicates the latest revision. Material changes will be highlighted on the website.

13. Contact us

GI Digital, Inc., 535 Fifth Avenue, 4th Floor, New York, NY 10017

Email: info [at] gi.digital · Phone: +1 332 245 3322