Privacy Policy

1. Who We Are

Cowboy Systems ("Cowboy Systems," "we," "our," or "us") is a healthcare software company providing an electronic health record (EHR), scheduling, billing, and practice management platform for physical therapy and wellness practices. Our registered address and contact details are provided at the end of this document.

2. Information We Collect

2.1 Practice and Provider Information

When you create an account or subscribe to our services, we collect:

• Name, title, and professional credentials
• Business name, address, and National Provider Identifier (NPI)
• Email address and phone number
• Billing and payment information (processed via PCI-compliant third parties)
• Login credentials (passwords are hashed and never stored in plain text)

2.2 Patient Data (Protected Health Information)

As a Business Associate under HIPAA, we process Protected Health Information (PHI) on behalf of covered entities (your practice). This includes:

• Patient demographics, contact information, and date of birth
• Medical history, diagnoses, treatment notes, and SOAP documentation
• Appointment records and scheduling data
• Insurance information and billing/claims records
• Telehealth session metadata

PHI is processed only as directed by the covered entity (the practice) and governed by our Business Associate Agreement (BAA). We do not use PHI for any purpose other than providing our contracted services.

2.3 Usage and Technical Data

We automatically collect certain technical data when you use the platform:

• IP address and approximate location
• Browser type, operating system, and device identifiers
• Pages visited, features used, and time spent in the application
• Error logs and performance data

3. How We Use Your Information

We use collected information to:

• Deliver, operate, and improve the Cowboy Systems platform
• Process billing and payments
• Provide customer support and respond to inquiries
• Send product updates, security notices, and service communications
• Comply with legal and regulatory obligations
• Detect fraud, abuse, and security threats

We do not sell your personal data or PHI to third parties. We do not use PHI for advertising or marketing purposes.

4. How We Share Information

We may share information with:

• Service providers: Cloud hosting, payment processors, and analytics providers who are contractually bound to protect your data
• Insurance and clearinghouse partners: For claims submission and eligibility verification, as directed by your practice
• Law enforcement: When required by applicable law, court order, or government regulation
• Successors: In the event of a merger, acquisition, or asset sale, with notice provided to you

5. HIPAA Compliance

Cowboy Systems acts as a Business Associate under HIPAA. We maintain appropriate administrative, physical, and technical safeguards to protect PHI as required by the HIPAA Security Rule. A signed BAA is available with all Growth and Enterprise plans. For more detail, see our HIPAA Compliance Statement.

6. Data Retention

We retain practice and account data for the duration of your subscription plus a minimum of 7 years, or as required by applicable law (including state-specific medical record retention laws). PHI retention periods are governed by the terms of the BAA and applicable state law. You may request deletion of non-PHI personal data by contacting us at the address below.

7. Data Security

We implement industry-standard security measures including:

• AES-256 encryption at rest and TLS 1.3 in transit
• Role-based access control and multi-factor authentication
• Continuous audit logging and intrusion detection
• Geo-redundant backups with automated disaster recovery
• Annual third-party security assessments

8. Cookies and Tracking

Our website and application use cookies and similar technologies to maintain sessions, remember preferences, and analyze usage. You may disable cookies in your browser settings, though some platform features may not function correctly without them. We do not use third-party advertising cookies on the clinical application.

9. Your Rights

Depending on your jurisdiction, you may have rights to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your personal data (subject to legal retention requirements)
• Object to or restrict certain processing
• Data portability (receive your data in a machine-readable format)

To exercise any of these rights, contact us at privacy@cowboysystems.com. We will respond within 30 days.

10. Children's Privacy

Our platform is not directed at children under 13. We do not knowingly collect personal information from children under 13 without parental consent. PHI relating to minor patients is handled in accordance with HIPAA and applicable state law governing minor patient records.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notice at least 30 days before taking effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.