Privacy Policy

1. Who We Are

WardLens provides a body camera platform purpose-built for clinical settings. Our products include video recording management, an AI-powered clinical documentation engine, and an incident tracking dashboard for healthcare safety directors.

For the purposes of HIPAA, WardLens operates as a Business Associate to covered entities (hospitals, health systems, and healthcare facilities) that use our platform.

Contact: wardlens@polsia.app

2. Information We Collect

The types of information collected depend on how you interact with WardLens:

Protected Health Information (PHI)

When healthcare facilities use WardLens in clinical settings, the platform may process the following PHI on behalf of the covered entity:

Data Type	Description	Retention
Video footage	Body camera recordings from clinical interactions	Per facility policy (configurable)
Audio recordings	Audio captured during body camera recordings	Per facility policy (configurable)
Transcriptions	AI-generated text transcriptions of clinical interactions	Per facility policy (configurable)
Clinical notes	AI-generated SOAP notes, progress notes, and ICD-10 code suggestions	Per facility policy (configurable)
Incident records	Workplace safety incident reports, which may reference patients	Per facility policy (configurable)
Patient identifiers	Patient ID, age, gender, and other demographic data entered during encounters	Per facility policy (configurable)

Staff & User Account Information

• Name, email address, and role/title
• Department and organizational affiliation
• Login credentials (passwords stored as bcrypt hashes; we never store plaintext passwords)
• Session data and access logs

Technical & Usage Data

• Browser type, device type, and operating system
• IP address and approximate location (for security monitoring)
• Pages viewed, features used, and session duration
• Error logs and performance metrics

3. How We Use Information

Protected Health Information

WardLens processes PHI solely on behalf of the covered entity and only for the purposes permitted in our Business Associate Agreement. These include:

• Storing, organizing, and serving body camera footage to authorized users
• Generating clinical notes from transcriptions using AI
• Tracking and managing workplace safety incidents
• Providing audit trails for compliance documentation
• Supporting the covered entity's treatment, payment, and healthcare operations as permitted

We do not use PHI for marketing, advertising, or any purpose unrelated to providing our services to the covered entity.

Staff & Usage Data

• Authenticating users and managing access permissions
• Improving platform reliability, performance, and security
• Generating de-identified, aggregate analytics about platform usage
• Communicating service updates and security notices

4. How We Store & Protect Information

See our HIPAA Compliance page for detailed technical controls. In summary:

• Encryption at rest: AES-256-GCM for all PHI
• Encryption in transit: TLS 1.2+ for all connections
• Access controls: Role-based access with principle of minimum necessary
• Audit logging: Immutable event logs on all data access
• Infrastructure: SOC 2 Type II certified cloud hosting
• Backups: Daily encrypted backups with cross-region replication

5. Who Can Access Information

Within Your Organization

Access to data within WardLens is controlled by the covered entity through role-based permissions. Only authorized users with appropriate roles can access PHI, and all access is logged.

WardLens Personnel

A limited number of WardLens personnel may access PHI when necessary to provide technical support, troubleshoot issues, or maintain the platform. All such access is:

• Limited to the minimum necessary for the specific task
• Logged in our audit system
• Covered by our BAA obligations and internal policies
• Performed by personnel who have completed HIPAA training

Third Parties

WardLens may use subcontractors to provide infrastructure and services. All subcontractors who may access PHI are bound by Business Associate Agreements. We do not sell, rent, or share PHI with third parties for their own purposes.

6. Data Retention & Deletion

Retention periods for PHI are determined by the covered entity and configured within WardLens. We support:

• Configurable retention periods per data type
• Automated secure deletion when retention periods expire
• Litigation hold capability to preserve records during legal proceedings
• Complete data export and deletion upon contract termination

Upon termination of a customer relationship, WardLens will return or destroy all PHI as specified in the BAA, and certify destruction in writing.

7. Patient Rights

Patients whose PHI is processed through WardLens retain all rights under HIPAA, including:

• Right to access: Patients may request access to their records through the covered entity
• Right to amendment: Patients may request corrections to their records through the covered entity
• Right to an accounting of disclosures: Patients may request a record of who has accessed their information
• Right to restrict use: Patients may request restrictions on certain uses of their information
• Right to confidential communications: Patients may request alternative communication methods

WardLens will cooperate with covered entities to fulfill patient rights requests as required by our BAA.

8. State-Specific Requirements

California (CCPA/CPRA)

If you are a California resident interacting with WardLens outside of a HIPAA-covered relationship (for example, as a website visitor), you have additional rights under the California Consumer Privacy Act:

• Right to know what personal information is collected, used, and shared
• Right to delete personal information
• Right to opt out of the sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising your rights

Note: PHI processed under HIPAA is exempt from CCPA. These rights apply only to non-HIPAA personal information.

Other States

WardLens complies with applicable state privacy laws including those in Colorado, Connecticut, Virginia, Utah, and other states with comprehensive privacy legislation. Contact us for state-specific inquiries.

9. Cookies & Tracking

WardLens uses minimal tracking technologies:

• Session cookies: Required for authentication and maintaining your login session. These are strictly necessary and cannot be disabled.
• Analytics: Basic page view tracking using a first-party pixel to understand platform usage. No third-party advertising trackers.

We do not use third-party advertising cookies, social media trackers, or cross-site tracking technologies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to covered entity customers via email and posted on this page with an updated effective date.

Continued use of WardLens after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

For questions about this Privacy Policy, data protection practices, or to exercise your rights: