In short
- Canter is sold to medical practices. Your practice decides what goes into Canter, and we process it only to run the service for the practice.
- Patient information in Canter is protected health information under HIPAA. Canter Health LLC is a business associate of each practice and signs a business associate agreement with it.
- We never sell data, never use it for advertising, and never use it to train AI models.
- Canter uses AI to draft and suggest. A clinician or staff member reviews before anything is filed or sent. The models run inside our own Amazon Web Services environment in the United States, and the model's maker cannot see the data.
- Everything is encrypted in transit and at rest, every account signs in with two factors, and no patient detail ever goes into a phone notification.
- To correct or delete your account, ask your practice administrator or email hello@canter.health. Patients should contact their practice.
Who this policy covers
This policy applies to the Canter web app at app.canter.health, the Canter iPhone app, and this website, canter.health. It is written for three groups of people.
- Practice staff who use Canter: physicians, medical assistants, billers, front-office staff and administrators. This policy calls you "you". Canter creates your account when your practice asks for it. Nobody can sign up on their own.
- Patients of those practices. Their information reaches Canter because their practice uses Canter. We hold it on the practice's behalf.
- Visitors to this website.
It does not cover the practice's own systems, such as its electronic medical record, billing system, phones and email. Those have their own policies.
What we ask of each person who uses Canter is in the terms of use.
Patient information and HIPAA
A practice that uses Canter is a covered entity under HIPAA, and Canter Health LLC is its business associate. Before a practice goes live we sign a business associate agreement with it. We use and disclose protected health information only as that agreement and HIPAA permit: to provide the service to the practice, as the practice instructs, and for our own administration and legal obligations where the agreement allows it.
Depending on which parts of Canter a practice turns on, we handle:
- Hospital rounding lists: the patient's name, date of birth, medical record number, hospital, dates of stay, diagnoses, and the services and charges the physician records.
- Faxes and emailed documents the practice receives, such as referrals, records, scheduling packets and hospital packets, and what the practice does with each one.
- Dictated visit audio, its transcript, and the draft note written from it.
- Reports from implanted cardiac devices that the manufacturer's monitoring service sends to the practice.
- Insurance coverage, eligibility checks and prior authorization requests.
- Text message conversations and phone calls between the practice and its patients.
- Photos that staff take of documents, such as a face sheet or an insurance card.
We do not sell patient information, use it for advertising or marketing, use it to train AI models, or combine one practice's information with another's. Each practice's data is kept apart.
If you are a patient: your relationship is with your practice, and the practice's Notice of Privacy Practices governs your information. Ask the practice to see your records, to correct them, or for an accounting of disclosures. We help the practice answer such requests, and we act on its instructions. If you text a practice that uses Canter, see how Canter uses AI and your choices.
If patient information is ever exposed, we notify the practice as our business associate agreement requires and help it meet its own notification duties.
Information about you
If you are practice staff with a Canter account, we hold:
- Your name, work email address, practice and role, set when the practice asks for your account.
- Your password, which the sign-in service stores only as a hash, and your authenticator-app enrollment for two-factor sign-in.
- Records of your sign-ins and of what you did in Canter: which patients, documents and charges you opened or changed, and when. HIPAA requires the practice to be able to see this.
- If you turn on alerts in the iPhone app: a device token that lets Apple deliver notifications to your phone, the app version, and whether it is a test build.
- If the practice gives you a phone extension: that extension and the records of the calls you make and take, meaning the numbers, time and duration.
- Email you send us.
We do not collect your location, your contacts or your photo library (only the photo you choose to take in the app), and we use no advertising identifiers. Canter contains no analytics or advertising software, and we do not track you across other apps or websites.
We use this information to run Canter for your practice, to keep accounts secure, to support you, and to tell you about changes to the service. Our basis for doing so is our agreement with your practice.
How Canter uses AI
Canter uses artificial intelligence to draft and to suggest. It suggests codes, modifiers and diagnoses from a note. It writes a draft visit note from a dictation. It sorts incoming faxes and emailed documents and proposes which patient and case they belong to. It reads a photo of a face sheet to start a rounding list. It summarizes device reports and points to what needs a look. When a practice turns it on, it answers routine administrative text messages about scheduling and office questions by choosing among replies the practice has approved.
People decide. Nothing is filed in a chart, sent to a biller, or sent to a patient until a clinician or staff member confirms it. AI drafts are labeled as drafts in the app. An urgent text message goes to staff, not to the assistant.
Which AI, and where it runs. Canter uses Claude models made by Anthropic, run through Amazon Bedrock inside Canter's own Amazon Web Services environment in the United States. Speech is turned into text by Amazon Transcribe and AWS HealthScribe. Amazon Polly produces the recorded voice prompts on a practice's phone line; those prompts contain no patient information. All of these run under our business associate agreement with Amazon Web Services.
The model's maker does not see the data. Amazon runs each model in accounts that the model provider cannot access, so Anthropic receives none of the prompts or outputs. Canter does not use practice or patient information to train or tune AI models, and the model maker never receives it. Our agreements with our providers, including our business associate agreement with Amazon Web Services, govern any other use of it.
Recording and messaging. A visit is recorded only when the clinician starts the recording after confirming the patient's consent. The screen shows that it is recording, and the clinician can stop at any time. A patient receives text messages only after replying YES to a message that explains the program, including that replies may be automated. Replying STOP ends the messages. Practice staff can see every conversation and take it over at any point.
Who else handles data
Canter runs on a small number of service providers. Each one that handles patient information is bound by a written agreement to protect it as HIPAA and this policy require.
| Provider | What it does for Canter | What reaches it |
|---|---|---|
| Amazon Web Services | Runs Canter in the United States: storage, computing, sign-in, encryption keys, speech-to-text, the AI models, patient text messaging and email delivery. | Everything Canter stores or processes, under a business associate agreement with Amazon Web Services. |
| Anthropic | Makes the Claude models Canter uses. | Nothing. The models run inside Amazon Bedrock in our environment, and Anthropic has no access to prompts or outputs. |
| Telnyx | The telephone and fax carrier for a practice's numbers. | Calls and faxes in transit between the practice and the telephone network, as any carrier handles them. |
| Microsoft 365 | The practice's own email, when a practice connects a mailbox such as its referral inbox so that Canter can file what arrives. Our own mailbox is also Microsoft 365. | Canter reads from the practice's mailbox with the practice's authorization and gives Microsoft nothing new. Email you send us is stored in our mailbox. |
| Insurance payers and clearinghouses (Availity, Optum, Stedi) | Eligibility checks and prior authorization requests that the practice sends through Canter. | The patient and coverage details each request needs, sent at the practice's direction as a HIPAA payment transaction. |
| Apple | Delivers notifications to the iPhone app. | The device token and the notification's fixed text, such as "A new fax arrived". Never a patient's name or any other detail. |
| Netlify | Hosts this website and receives its enquiry form. | Website visits, in ordinary server logs, and what you type in the form. No patient information belongs here. |
| Google Fonts | Supplies the typefaces on this website. | Your browser's request for the font files, which includes its IP address. |
Device manufacturers' monitoring services, such as those run by Medtronic, Boston Scientific and Abbott, send transmission reports to the practice through Canter. They are a source of information, not a recipient.
Beyond these, we disclose information only at the practice's direction, or when the law requires it, in which case we tell the practice unless the law forbids it. If Canter Health LLC is ever sold or merged, the new owner takes on this policy and our business associate agreements.
Keeping it safe
- All traffic is encrypted in transit, and everything stored is encrypted at rest with keys we control in Amazon Web Services.
- Data stays in the United States.
- Every account signs in with a password and an authenticator app. There is no way to turn the second factor off.
- Roles limit what each person sees. A biller sees billing; a front-office account does not see clinical notes it has no reason to see.
- Each practice's data is partitioned from every other practice's.
- Every sign-in and every change is logged. The service's own request logs record identifiers, status and timing, never clinical content.
- On an iPhone, the app locks behind Face ID or the device passcode when it opens and after five minutes away, and covers its screen in the app switcher.
- A staff member's access ends when the practice tells us they have left.
- Our own staff open production data only to run and support the service, under the same rules.
No system is perfectly secure. If you believe something is wrong, write to hello@canter.health with "Security" in the subject line.
How long we keep it
| Information | Kept for |
|---|---|
| Patient records in Canter: rounding lists, documents, notes, messages, device reports | As long as the practice uses Canter. When the agreement ends, the records are returned to the practice or destroyed, as the business associate agreement provides. |
| Dictation audio | Deleted within three days of upload. |
| Transcripts and AI working files from a dictation | Thirty days. The finished note stays with the patient's record. |
| Documents a user deletes | Recoverable for thirty days, then permanently removed. |
| Sign-in and activity records | One year, or longer where the practice's agreement requires it. |
| Your staff account | Until the practice removes you, then deleted within thirty days. Records of what you did stay with the practice's activity records. |
| Enquiry form submissions and email to us | As business records, until no longer needed. Deleted on request. |
Your choices
Practice staff. To correct your name or email, or to delete your account, ask your practice administrator or email hello@canter.health. We delete the account within thirty days. The practice's records of what was done in Canter, which HIPAA requires it to keep, are not changed by deleting the account. On an iPhone you can turn off Face ID, the microphone, the camera or notifications for Canter at any time in Settings; the related feature then stops working, and nothing else does.
Patients. Contact your practice for access to your records, corrections, and questions about how it uses Canter. To stop text messages from a practice, reply STOP. Reply HELP for help.
State privacy laws. Canter acts as a service provider to each practice. Patient information is governed by HIPAA rather than by state consumer privacy laws, and your practice is the right place to exercise rights over it. For anything else, email us and we will honor the rights the law gives you. We do not sell personal information or share it for advertising, so there is nothing to opt out of, and we never treat anyone differently for exercising a right.
Children. Canter is for practice staff and is not directed to children under 13. Patient records may include a minor's information, which we handle under HIPAA on the practice's behalf.
The iPhone app
The Canter iPhone app is the same application in a native shell. It loads app.canter.health and signs in with the same account. The phone keeps only your sign-in session and the app's ordinary cache; records live in Canter, not on the device.
- Face ID unlocks the app. The check happens on the phone, and no biometric data leaves it or reaches Canter.
- Microphone, for visit dictation and for practice phone calls.
- Camera, to photograph documents such as insurance cards and face sheets. The app never reads your photo library.
- Notifications carry a fixed message with no patient detail. You open the app to see what it is about.
Links to this website open in Safari. In App Store terms, the app collects contact information, user content, audio and identifiers linked to your account, and no data for tracking.
This website
canter.health is a static site with no cookies, no analytics and no advertising trackers. Netlify, which hosts it, keeps ordinary server logs of visits to run the site and defend it against abuse. The pages load typefaces from Google Fonts, so your browser sends its request, including your IP address, to Google. The enquiry form asks for your practice, your name and role, your work email and phone, your specialty and the EMR you use; we use that to reply to you and for nothing else. Please do not send patient information through this website or by email. The "Sign in" links lead to app.canter.health, which the rest of this policy covers.
Changes to this policy
When we change this policy we post the new version here with a new effective date. If a change matters to how we handle a practice's information, we tell the practice by email before it takes effect. Earlier versions are available on request.
Contact
Canter Health LLC
hello@canter.health for privacy questions, deletion requests and security concerns.
A patient who believes their health information has been mishandled may complain to their practice or to the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/complaints.