Legal
Privacy Policy
Sakura Health, Inc.
·
Effective date: September 14, 2026
Sakura Health, Inc.
·
Effective date: September 14, 2026
This Privacy Policy describes how Sakura Health, Inc., its affiliates, and subsidiaries (collectively, "Sakura," "we," or "us") collect, use, disclose, and otherwise process the personal data described in this Policy. For information about your privacy choices, please review Section 10.
Your use of our Services, and any dispute over privacy, is subject to this Privacy Policy and our Terms of Service.
Scope: Except as otherwise described below, this Privacy Policy applies to the personal data Sakura collects and processes related to your use of our website, sakurahealth.ai, where this Privacy Policy is posted, our AI agent platform, and any related products and services we may make available to you (collectively, "Services").
Not in Scope: This Privacy Policy does not apply to the personal data that we process in our capacity as a service provider to our customers ("Business Customers"). In general, we process personal information that we receive in our capacity as a service provider for the purposes for which our Business Customers provided the personal information and subject to our contract with the particular Business Customer ("Customer Data").
Protected health information. In certain circumstances, we may collect or use your information through our Services while acting as a "business associate" under the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations ("HIPAA"), and your information may constitute "Protected Health Information." A business associate includes an entity that provides services to a HIPAA covered entity which involves the use or disclosure of Protected Health Information. If your health care provider qualifies as a HIPAA covered entity, and we provide services to them or on their behalf, we may qualify as their business associate. Protected Health Information as defined under HIPAA generally means information about you that identifies you and that relates to your physical or mental health or condition, the provision of health care to you, or payment for health care provided to you. To the extent we are acting as a business associate, we will only use and disclose your information as permitted by HIPAA, which may include, but is not limited to, fulfilling our service obligations, for our internal management and administration, executing our legal responsibilities, de-identifying or aggregating data, or as otherwise required by law. Consult your healthcare provider's Notice of Privacy Practices for information about its PHI practices.
From healthcare professionals and professional account users, we collect profile and contact data, such as names, email addresses, business phone numbers and addresses; account credentials and identifiers; professional information provided to us; device and IP information; and website usage and analytics information.
From website visitors and demo requesters, we collect contact information and information submitted through our forms, along with device, IP, and analytics information. Providing a mobile number is optional.
We receive information directly from individuals and customers, through connected systems and authorized workflow participants such as providers and payers, automatically through use of the Services, and from service providers and business partners.
We use personal data to deliver and support the Services; manage accounts; respond to inquiries and demo requests; communicate according to your preferences; maintain, customize, and improve the Services; prevent fraud and protect security; and meet legal obligations and enforce agreements.
Where enabled and legally permitted, communications may be recorded, transcribed, or summarized for service delivery and support. We provide required disclosures for communications we operate and do not record or transcribe without legally required consent.
We will provide notice before collecting additional categories or using information for materially different, unrelated, or incompatible purposes, and obtain consent where required.
We process Customer Data to provide, support, secure, evaluate, and improve the Services for the customer, including through AI and automation, subject to the applicable agreement, BAA, and applicable law.
We do not use Customer Data, including aggregated or de-identified derivatives, to train or fine-tune AI models, or allow AI service providers to do so. We do not sell identifiable Customer Data or use it for targeted advertising.
When you book a demo, you may provide a mobile phone number. Providing a number is optional and is not a condition of booking a demo or of any purchase. Sakura sends text messages only with your express consent. We send two kinds of messages and ask for your consent to each separately: messages about your demo (confirmations, reminders, and follow-ups) and marketing messages about Sakura Health events and product updates.
You may consent to either, both, or neither, and consenting to one does not enroll you in the other. Message frequency varies. Message and data rates may apply. Reply STOP to cancel at any time, or HELP for help. You may also withdraw consent by emailing privacy@sakurahealth.ai.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. We do not sell, rent, or share your mobile phone number or your SMS consent with any third party or affiliate for their marketing purposes. The opt-in is not transferable to another party involved in the process. Mobile information collected for text messaging is used only to deliver the messages you have agreed to receive. Our telecommunications and messaging vendors process your number solely on our behalf and at our instruction to deliver those messages and for no other purpose.
Our scheduling provider may send its own appointment reminder text to the number you enter. Those messages are sent by the provider under its own terms and are separate from the Sakura Health messaging program described here.
We disclose Personal Data to service providers supporting hosting, technology, communications, AI processing, security, and customer support; analytics providers; relevant business partners and customers; and parties you authorize. Service providers processing Customer Data are subject to appropriate confidentiality and data-protection obligations, including BAAs where required.
For authorized customer workflows, we may exchange relevant information with the customer, providers, payers, clearinghouses, and other authorized participants. These participants may act independently under their own privacy obligations.
We may also disclose information as follows:
Disclosures of Customer Data remain subject to the applicable agreement, BAA, and applicable law.
We may share aggregated or de-identified information for lawful business purposes, including improving workflows, service quality, and features. For Customer Data, these activities are subject to the applicable agreement, BAA, and law, including HIPAA de-identification requirements. The no-model-training restriction above also applies to this data. We do not attempt to re-identify it and require recipients to observe applicable restrictions against re-identification.
The Services use cookies and similar technologies to recognize browsers, operate features, remember preferences, and understand usage. These include essential, functional, and performance or analytics cookies, including through providers such as Google Analytics. You can learn more about how Google uses your information at www.google.com/policies/privacy/partners/ ("How Google uses information from sites or apps that use our services"). You can also download the Google Analytics Opt-out Browser Add-on to prevent your information from being used by Google Analytics at https://tools.google.com/dlpage/gaoptout.
You can control cookies through your browser settings; disabling cookies may affect features. The Services do not currently respond to "Do Not Track" signals. This statement does not limit any obligation to honor other opt-out preference signals required by applicable law.
We have implemented safeguards that are intended to protect the personal data we process from loss, misuse, unauthorized access, disclosure, alteration, and destruction. Please be aware that despite our efforts, no data security measures can guarantee security.
We retain personal data while an account is active or as needed to provide the Services, and longer where necessary for legal obligations, disputes, or enforcement of agreements. Customer Data, including recordings and workflow records, is retained, returned, or deleted according to the applicable agreement, BAA, and applicable law, which control over general retention descriptions here.
Our website and business accounts are intended for adults. We do not knowingly solicit accounts or direct submissions from children under 18. If we learn that a child has submitted information directly outside an authorized customer workflow, we will take appropriate steps to delete it. Contact privacy@sakurahealth.ai if you believe this has occurred.
We may process information about minors on behalf of customers for authorized healthcare workflows under the applicable agreement, BAA, and applicable law.
For information we process on behalf of a customer, including patient records, contact the relevant provider or customer. We will assist or route requests as required by our agreements and applicable law. Nothing in this policy limits rights available under HIPAA or other applicable law.
We may update this policy and will provide notice of material changes through our website, email, or another appropriate method, as required by law. Updates take effect on the stated effective date and do not amend a signed customer agreement or BAA. We will obtain consent where required.
Sakura Health, Inc.
400 Concar Dr, Office 02-126
San Mateo, CA 94402
privacy@sakurahealth.ai
https://sakurahealth.ai