PrimedHealth
Privacy policy
1. Who we are and who this covers
PrimedHealth is software that helps surgery centers get patients ready for surgery. Surgery centers are our customers. Their staff use PrimedHealth to see what each patient still needs before surgery. Patients use the PrimedHealth patient page to see what their surgery center asks of them, to answer questions, and to write to their surgery center.
This policy covers three groups of people:
- Surgery centers that use PrimedHealth.
- Staff of those surgery centers who sign in to PrimedHealth.
- Patients of those surgery centers.
We provide PrimedHealth to your surgery center. When we hold your health information, we hold it to provide that service to your surgery center. Your surgery center has its own privacy practices, and they also apply to your information.
Section 15 covers visitors to this website, primedhealth.ai.
2. What we collect
Staff accounts
- Your name, your work email address, your surgery center, and your role (for example care coordinator, clinician, administrator or auditor).
- Your sign-in account, which Amazon Cognito holds. PrimedHealth's servers never see your password. Staff must also set up an authenticator app.
- A record of what you do in PrimedHealth, such as approving a draft or adding someone to a care team (see "Audit log" in section 9).
- The last time you opened each case you are on.
- Questions you type to the AI Case Assistant, and its answers (see section 4).
Surgery center details
- Facilities, their phone numbers and time zones, operating rooms, and surgery schedules.
- Settings the center's administrator chooses, such as whether texts to patients are on.
Patient and case records a surgery center imports or enters
- Your name, date of birth, medical record number, mobile phone number and email address.
- A second phone number, if your surgery center records one, and whether a care coordinator says they confirmed each number with you or your family.
- Your surgery: the procedure, the procedure code, the surgeon, the facility, and the date and time.
- The checklist of what must be done before your surgery, and what has been done.
- Chart information your surgery center adds, such as problems, medicines, allergies, test results, vital signs and notes.
- Files your surgery center adds, such as a clearance letter, lab results or a history and physical.
- Messages your care team writes to you.
- Whether you agreed to receive texts, and how (see section 5).
PrimedHealth does not yet connect to a surgery center's electronic health record system for real patients.
What you enter in the patient page
- Your date of birth, to confirm that the invitation is yours.
- Your answers to pre-surgery questions, and any details you add.
- That you say you have done an item on your checklist. Your word is kept as yours. It does not mark the item as done.
- Messages you write to your surgery center.
Texts and emails we send
- For each text: when it was asked for, who asked for it, and whether our text service accepted it.
- For each email to staff: when it was asked for, and whether our email service accepted it.
Usage records and logs
- Our servers keep a short record of each request: the kind of request, the page address without anything after a "?", the result, and how long it took. This record does not include what you typed, your sign-in, or your IP address.
- Our network keeps a record of connections for 90 days, to keep the service secure. It holds the internet addresses and ports of each connection, which can include your device's IP address. It does not hold what was sent.
- We do not use advertising or analytics tools.
Cookies and browser storage
- PrimedHealth's own pages set no cookies. They load scripts, fonts and images only from PrimedHealth, and connect only to PrimedHealth and to Amazon Cognito's sign-in pages.
- Amazon Cognito's sign-in pages keep their own sign-in session in your browser.
- Staff pages keep a few things in the browser on that computer: the staff sign-in, for up to 24 hours or until you sign out; light or dark display; whether the case chat is open; whether the welcome guide was shown; when you last looked at the Today page; and which list rows you cleared, kept as codes and not words. For the open browser tab only, they also keep which surgery center and case you last viewed, a few display choices, two short codes used while you sign in, and the page to return to after you sign in. None of these holds a patient's name or health information.
- The patient page keeps two short codes in the browser while you are at the sign-in page, and deletes them when you come back. If it signs you out by itself, it keeps one word saying why, until you return. It keeps nothing else about you.
3. How we use information
- To run PrimedHealth for your surgery center: to show the care team what each patient needs before surgery, and what is late.
- To show you, as a patient, your own surgery, checklist, messages and questions.
- To send the texts and emails described in sections 5 and 6.
- To have AI agents draft work for staff to review (section 4).
- To check each case by fixed rules, not by AI: for example, whether open checklist items make the surgery likely to be cancelled, or whether a phone number looks wrong or a patient may be entered twice. Staff see these checks. Patients do not, and no AI agent is given them.
- To keep the service secure, to find and fix faults, and to keep a record of who did what.
We do not sell personal information. We do not use it for advertising.
4. How we use AI
Agents draft. People decide. PrimedHealth uses AI "agents" to help staff. An agent drafts work, such as a summary of what a case still needs, a work-up plan, a proposed time for surgery, an extract of the chart, or a message to a patient. A draft does nothing until a person approves it.
Nothing clinical is sent automatically. A message reaches a patient only when a staff member approves it and places it in the patient's page. A text is sent only for a message a person placed, or for an invitation a person sent (section 5).
When agents run. An agent runs when a staff member starts it, when a staff member approves a plan that lists it, when someone is added to a case (only if the surgery center's administrator turns that on), or in a daily round each morning (the center can pause it).
Answers to staff questions. A staff member can type a question about a case. The Case Assistant, an agent, answers it. That answer is shown to the center's staff who can read the case, without anyone approving it first. It is labeled "AI generated". It is never shown to a patient. It cannot send anything or change the record.
What the AI is given. Our tools give an agent the parts of a case it needs. Apart from a file an agent is asked to read (below), they do not give it your name, date of birth, medical record number, phone number, email address or home address, and they give dates as a number of days and an age over 89 as "90+". Three agents can also read chart facts, such as problems, medicines, allergies and results. They are not given the words of notes. For a real patient, they do so only after PrimedHealth turns chart reading on for that surgery center, and each change is written in the center's audit log. If a staff member types your name into a question, the question goes to the AI as typed.
No agent reads the messages you write to your surgery center. For a real patient, no agent reads the files staff add, or your answers to pre-surgery questions, until PrimedHealth turns that on for your surgery center, and each change is written in the center's audit log. Once it is on, an agent is given a file as it is, with any name, date of birth or medical record number on it. It is given your answers, but not the words of any detail you add.
The record of each run. What an agent was given and what it wrote are kept with the case. Only staff who can read the case's details, and PrimedHealth staff who have opened the center's records (section 9), can read them.
The models. The agents use Claude models made by Anthropic (today, Claude Sonnet 4.6), through Amazon Bedrock, a service of Amazon Web Services (AWS). Requests to the model are processed in AWS regions in the United States: Northern Virginia, Ohio and Oregon.
Training. Amazon states that content processed by Amazon Bedrock is not used to improve its base models and is not shared with model providers (Amazon Bedrock FAQs, https://aws.amazon.com/bedrock/faqs/, read October 20, 2026). Amazon also states that model providers have no access to customers' prompts and completions (Amazon Bedrock User Guide, "Data protection", https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html). Amazon describes limited cases in which it may store inputs and outputs to detect abuse (Amazon Bedrock User Guide, "Amazon Bedrock abuse detection", https://docs.aws.amazon.com/bedrock/latest/userguide/abuse-detection.html).
PrimedHealth does not train AI models on your information.
5. Text messages (SMS)
What the program is. If your surgery center uses PrimedHealth texts, you may receive text messages about your own upcoming surgery. The texts come from PrimedHealth on behalf of your surgery center. Texts are off until your surgery center's administrator turns them on.
How you agree. Your surgery center's care coordinator asks whether you agree to receive these texts, usually on a call or in person. If you say yes, the coordinator records it in PrimedHealth: your mobile number, the date and time, how you agreed (on a form, in person or on a call), and who recorded it. You receive texts only if your yes is recorded.
Consent is not a condition of care. You do not have to agree to texts to receive care. Saying no does not affect your care.
What we text.
- A message your care team approved and placed in your patient page, such as a reminder of the date and time of your surgery, or instructions.
- When you are invited to the patient page, one text with the web address where you sign in.
A staff member at your surgery center approves every text before it is sent. We do not send marketing texts.
Texts may include the date, time and place of your surgery. Anyone who can see your phone may be able to read them.
When. Texts are sent only between 8 am and 9 pm, by the clock where your surgery center is. They are sent only to a United States or Canadian phone number, and only while your surgery is scheduled or postponed, not after it is cancelled or done.
How often. Message frequency varies, usually 2 to 6 texts per surgery.
Cost. Message and data rates may apply.
STOP. Reply STOP to any text to stop receiving texts. You will receive one confirmation and no further texts. When our text service tells us that you replied STOP, we end the record of your yes. We do not text you again unless a new yes is recorded.
HELP. Reply HELP for help, or contact your surgery center or us (section 14).
Other ways to stop. You can ask your surgery center to stop texts at any time. Staff record that you asked, and the texts stop.
If your number changes. If your mobile number on record changes or is removed, your yes ends with it. A new yes is needed for the new number.
What we keep. Your mobile number is kept in your record. We do not text a second number on your record. For each text, we keep when it was asked for, who asked for it, and whether our text service accepted it. That record does not hold your number or the words of the text. The words of a message stay in your patient page. We do not know whether a text reached your phone, or whether you read it.
Sharing. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are never shared with any third party. We send texts through AWS End User Messaging, a service of Amazon Web Services, only to deliver them.
Our text messaging terms are at https://primedhealth.ai/sms-terms/.
6. Email
Sign-in emails. When you are first invited to PrimedHealth, Amazon Cognito emails you a username, a temporary password, and the address where you sign in. If you reset your password, Amazon Cognito emails you a code.
Emails to staff. When a staff member is added to a case's care team, we may email them that a case is waiting. The email names no patient and nothing about the case. A surgery center's administrator can turn these emails off. We send them through Amazon Simple Email Service from a no-reply address. Replies are not read.
Patients. PrimedHealth does not email patients about their care. We do not send marketing emails.
7. The patient page
Invitation. Your surgery center invites you to the patient page by email. An invitation lasts 3 days. Your surgery center may send it to an address other than the one on your record, such as a parent's or guardian's. If it does, staff must record why.
Signing in. You sign in with your email address and a password you choose. You may be asked to set up an authenticator app as well. The first time, you confirm your date of birth. After five dates that do not match, the invitation closes. The page asks for your password every time. It signs you out after 15 minutes with nothing done, and within an hour in any case.
What you see. Your surgery, your checklist, messages from your care team, and answers your surgery center approved on a few common topics (where to park and which door, who to call, moving your surgery date, and feeling unwell before surgery). You see pre-surgery questions only after a care coordinator or clinician at your surgery center has approved them.
Your answers to pre-surgery questions. Each answer you save is kept. While your surgery center uses PrimedHealth, the database refuses any change to it or deletion of it. Staff who can read your case can read your answers. Nothing scores them. For a real patient, no AI reads them until PrimedHealth turns that on for your surgery center (section 4). The staff page marks some answers, from a fixed list, as ones to look at.
Messages you write. You can write to your surgery center if it has turned this on. A message can be up to 1,000 characters. It is kept as you wrote it. While your surgery center uses PrimedHealth, the database refuses any change to it or deletion of it. Staff who can read your case can read it. No AI reads it today.
Nobody is alerted. PrimedHealth does not alert staff by text, email or call when you write a message or answer a question. Staff see it when they next open a page in PrimedHealth that lists it. If you feel unwell or need an answer soon, call your surgery center. In an emergency, call 911.
What your record does not note. Your record does not note which parts of the page you look at, or when you read a message.
9. Security
Where your information is. PrimedHealth runs on Amazon Web Services in the United States. Records, files and logs are kept in the Northern Virginia region (us-east-1). Requests to the AI model may also be processed in Ohio or Oregon (section 4).
Encryption. Connections to PrimedHealth use TLS 1.2 or 1.3. Connections inside our network to the software that handles your information, and to the database, are encrypted too. The database and the files are encrypted with keys we hold in AWS Key Management Service. The keys rotate automatically. The logs of our software are encrypted with a key we hold too.
Files. The place files are kept has no public access. A file can be seen only through PrimedHealth, by someone allowed to see it.
Each surgery center is kept apart. The database itself keeps each surgery center's records apart from every other center's. A request that does not say who is asking sees nothing.
Within a surgery center. The database decides which staff can see which cases, by the access the center gives them. An auditor can see that something happened, but not the clinical details.
Access by PrimedHealth staff. PrimedHealth staff can see how the service is running for a surgery center, such as that an agent ran, without opening patient records. To see patient records in PrimedHealth, a PrimedHealth staff member must open that center's records, with a reason, for up to eight hours at a time. Each opening is written in that center's own audit log.
Sign-in. Staff passwords have at least 12 characters, and staff must use an authenticator app. A staff sign-in lasts up to 24 hours on one computer. Patient passwords also have at least 12 characters.
Audit log. Each surgery center has an audit log. It records who did what, to what, and when. While the center uses PrimedHealth, the database refuses any change to an entry or removal of one. It does not hold what a draft says. A center's administrators and auditors, and PrimedHealth, can read it.
What is kept out of logs. Our request logs do not hold what you typed, your sign-in, or your IP address. The part of our software that sends texts writes no phone number to any log. Audit log entries about a phone number or a yes to texts do not hold the number. Your answers to pre-surgery questions are not put in audit entries, logs, web addresses or email subjects. The lines our agent software writes to its log do not hold anything the AI wrote. The database's own logs are set not to record the values written to it.
Our pages. Our pages run only code that PrimedHealth serves, and load nothing from other websites.
No system is perfectly secure.
10. Retention and deletion
How long. We keep a surgery center's records while the center uses PrimedHealth. Records are not deleted automatically.
Records kept as written. While a surgery center uses PrimedHealth, the database refuses to delete its audit log, patients' answers to pre-surgery questions, messages to and from patients, drafts and the decisions on them, or the records of agent runs. It also refuses any change to the audit log, the answers, the messages and the run records. A decision on a draft can be taken back, and that is recorded too.
Deleting a surgery center. PrimedHealth can delete all of a surgery center's records at once. The center's own administrator cannot. PrimedHealth staff can make a copy first (section 8). Files the center added are deleted with it.
What is left after. One line remains: the center's name and kind, who deleted it and when, whether a copy was made, how many records were deleted, and how many sign-in accounts were left. It holds nothing about any of the center's patients or staff.
What deleting does not remove at once.
- Older copies of files are purged 30 days after they are deleted or replaced.
- Database backups are kept until they expire.
- Sign-in accounts at Amazon Cognito are not removed. They no longer open anything.
Logs. The logs of our software, our network and our database are deleted automatically after 90 days.
AI requests. See "Training" in section 4 for what Amazon states about requests to Amazon Bedrock.
11. Children and guardians
Patients of surgery centers may be children. PrimedHealth is not meant to be used by children on their own.
- The record may show that a patient is under 18. The AI agents are told the patient's age in years, and whether it is under 18. They are not told who may give consent.
- A surgery center may send the patient page invitation to a parent's or guardian's email address. Staff must record why.
- Whoever signs in must confirm the patient's date of birth.
- Today, staff cannot record a parent or guardian as a separate person in PrimedHealth.
12. Your choices and rights
Texts. Reply STOP to any text, or ask your surgery center (section 5).
Seeing or correcting your information. We hold patient information for your surgery center. To see, copy or correct your information, contact your surgery center. We will help your surgery center answer you.
Staff. Ask your surgery center's administrator about your account, or contact us.
Surgery centers. A center's administrator can turn on or off texts to patients, messages from patients, emails to staff, and agents that start when someone is added to a case. A care coordinator or administrator can pause the daily round, and can turn off or change the reminders before surgery. To have the center's records deleted, contact us.
13. Changes to this policy
We may change this policy. When we do, we will change the date at the top.
14. Contact
For questions about your care or your information, contact your surgery center. To stop texts, reply STOP to any text; for help, reply HELP.
15. This website
Sections 1 to 14 are about the PrimedHealth software. This section is about primedhealth.ai, the website you are reading now.
- It sets no cookies and uses no advertising or analytics tools.
- It loads its fonts from Google Fonts, so your browser sends your IP address to Google when a page loads.
- Our web host keeps standard server logs of each visit, which include your IP address and browser type.
- "Book a demo" opens a Google Calendar booking page, which Google runs. If you book a demo or email us, we use what you send only to reply to you.