Legal
Privacy Policy
Last updated: November 4, 2026
1. Scope and our role
This Privacy Policy (“Policy”) describes how PeakLogic, Inc. (“PeakLogic,” “we,” “us,” or “our”) collects, uses, and discloses personal information in connection with:
- Our websites, including prtms.com and peaklogic.co;
- Our web applications, APIs, and portals for healthcare organizations, the PrTMS by PeakLogic desktop application, and the intake, survey, and consent links we send to patients on a clinic’s behalf (collectively, the “Services”); and
- Support requests, contracting, and account administration.
Most information about patients in the Services is entered by a clinic or collected from patients on the clinic’s behalf. For that information the clinic is the HIPAA covered entity and PeakLogic is its business associate. The clinic decides what is collected and how it is used in the patient’s care, and the clinic’s Notice of Privacy Practices applies. Our processing of that information is also governed by our business associate agreement and other agreements with the clinic. If one of those agreements conflicts with this Policy, the agreement controls. Patients can read a shorter summary in our Patient Privacy Notice.
2. Definitions
- “Personal information” means information that identifies, relates to, or could reasonably be linked with a particular individual, as defined under applicable law.
- “PHI” means protected health information as defined in the Health Insurance Portability and Accountability Act of 1996 and its regulations (“HIPAA”).
- “De-identified information” means information that has been de-identified under the HIPAA standard and cannot reasonably be linked to an individual.
- “You” means anyone who uses our websites or Services, including clinic staff, patients who use links a clinic sends them, and parents, guardians, or others who complete forms for a patient (“proxies”).
3. Information we collect
3.1 Clinic staff and customers
Name, professional title, work email address, billing contact details, organization, clinic, role, and account identifiers.
3.2 Sign-in and security
Sign-in and session records, multi-factor authentication enrollment, role assignments and permissions, and the IP address and browser details recorded with requests to the Services.
3.3 Clinical content
When a clinic uses the Services, we process the content that the clinic, its staff, or its patients submit or generate. This includes patient identifiers, demographics, and contact details; medical history and intake answers; EEG recordings and the measurements derived from them; survey responses; treatment plans and treatment records; visit notes and staff dictation; PeakReveal reports; and documents and signed consent forms uploaded to the chart.
3.4 Patients and proxies using links we send
A clinic can ask us to send a patient or a proxy a link to complete an intake form, a survey, or a consent form. What we collect through these links is described in our Patient Privacy Notice.
3.5 Communications you send us
When you contact us by email, phone, or the in-app support forms, we collect what you send and related details such as attachments, the page you were on, and your browser and app version.
3.6 Technical data
IP address, browser and operating system, the pages and API endpoints requested, error and upload diagnostics, and, if you turn on browser notifications, the notification address and browser type your browser provides. We do not use third-party analytics, advertising, or session-recording tools.
3.7 Information from others
Clinics, which create staff accounts and enter patient information; our sign-in provider; our payment processor, for clinic subscriptions and invoices; and our email and text message providers, for delivery and opt-out status.
4. How we use information
- To provide, operate, support, and improve the Services;
- To secure the Services and prevent fraud, misuse, and unauthorized access;
- To comply with law and enforce our agreements;
- To send service, security, and administrative messages; and
- For the de-identified uses described in Section 12.
5. How we disclose information
We disclose personal information to:
- Your organization and its authorized users, according to their roles;
- Service providers that host the Services, provide sign-in, deliver email and text messages, handle support tickets, or process payments for us, under written agreements that limit their use of it;
- Professional advisors under confidentiality obligations;
- Authorities, when required by law;
- A successor in a merger, acquisition, or sale of assets, subject to the same commitments; and
- Others at your direction or your organization’s direction.
For PHI we receive from a clinic, we use and disclose it only as our agreement with the clinic and HIPAA permit.
6. No sale or targeted advertising
We do not sell personal information and do not use it for targeted advertising. We do not use tracking technologies on our websites, so “Do Not Track” and Global Privacy Control signals do not change how they behave.
7. HIPAA
Where we handle PHI for a clinic, we comply with HIPAA and our business associate agreement, including its safeguards, minimum necessary access, and breach notification requirements. To see, correct, or get a copy of your records, or to withdraw a consent you gave the clinic, contact your clinic. If you contact us instead, we will refer you to your clinic and help the clinic respond as our agreement with it requires.
8. Service providers
We use service providers for hosting, sign-in, email and text message delivery, speech transcription, AI models, customer support, and clinic billing. Providers that handle patient information do so under a business associate agreement with us and are listed on our Subprocessors page.
10. Logs
The Services record requests in an audit log, including the user or link involved, the action, and the time. We keep server, application, and security logs, which include IP addresses, to operate the Services, investigate incidents, and meet HIPAA audit requirements.
11. Messages we send
We send service and security messages needed to operate accounts and the Services. You cannot opt out of these while you have an account.
11.1 Patient text messages
With a patient’s agreement, recorded by clinic staff, we send text messages on the clinic’s behalf that contain a secure link to complete an intake form or a survey. A clinic can record the same agreement for a proxy, and survey texts then go to the proxy’s own number. Message frequency varies by treatment stage. Message and data rates may apply. Reply HELP for help, or contact support@prtms.com. Reply STOP at any time to stop these messages.
We use mobile phone numbers and text message consent only to send these messages. We do not sell them, and we do not share mobile phone numbers, text message opt-in data, or consent with third parties or affiliates for marketing or promotional purposes. Full terms are in our SMS Terms.
11.2 Patient emails and staff notifications
With a patient’s agreement, we email intake, survey, and consent links on the clinic’s behalf. Clinic staff receive email and, if they turn it on, browser notifications about work in their clinic, which can include the patient’s name.
If we send marketing messages, you can opt out using the unsubscribe link in them or by contacting us.
12. De-identified information
We use de-identified information for research and to develop and improve our products and services.
13. AI-assisted reports
We use AI models, run in our own AWS account under our business associate agreement with AWS, to help draft PeakReveal report summaries that clinic staff review.
14. Retention
We keep information for as long as needed to provide the Services and as our agreements with clinics require.
15. Security
We use administrative, technical, and physical safeguards appropriate to the risk, including role-based access controls, encryption at rest and in transit over public networks, monitoring and logging, vendor agreements, and staff training. No method of transmission or storage is completely secure. Keep your sign-in details safe and follow your organization’s security policies.
16. Where information is stored
The Services are hosted by Amazon Web Services in the United States. If you use our websites or Services from outside the United States, your information is transferred to and processed in the United States.
17. Your privacy rights
Depending on where you live, you may have the right to access, correct, delete, or get a copy of your personal information, and to appeal our decision on a request. To make a request, email support@prtms.com. We may need to verify your identity, and you may use an authorized agent where the law allows. We will not discriminate against you for exercising these rights.
For patient information we hold for a clinic, contact your clinic. We will help the clinic respond as our agreement with it requires.
18. Children
Our websites and Services are not directed to children. Clinics may treat patients under 18, and a parent or guardian may complete forms for them. That information is handled under HIPAA and our agreement with the clinic.
19. Other websites
Our websites may link to other sites, which are governed by their own privacy policies.
20. California residents
The categories of personal information we collect, why we collect them, who we disclose them to, and how long we keep them are described in Sections 3, 4, 5, and 14.
21. Changes to this Policy
We may update this Policy. We will post the revised Policy on this page and update the “Last updated” date, and we will give additional notice of material changes where the law requires.
22. Contact us
For privacy questions, requests, or complaints, email support@prtms.com, call (619) 877-8672, or write to:
PeakLogic, Inc.
12625 High Bluff Drive, Suite 318
San Diego, CA 92130
United States