Privacy Policy

Last updated: October 21, 2026

1. Introduction

This Privacy Policy describes how Ifat Shterenberg, a sole proprietor based in California, United States ("Hlistix", "we", "our", or "us"), collects, uses, discloses, and protects information processed through the Hlistix software-as-a-service platform (the "Service").

HLISTIX is an educational research, professional reference and documentation platform for qualified healthcare practitioners. The Service provides structured access to research and professional reference materials, practitioner-controlled documentation tools, and practitioner-facing software functions that may surface contextually relevant information based on practitioner-entered information.

The Service does not independently diagnose disease or other conditions, prescribe or select treatment, generate a patient-specific treatment plan or treatment directive, or replace the independent professional judgment of a qualified healthcare practitioner.

2. Information We Collect

2.1 Information You Provide

Account and Professional Information

  • Full name
  • Email address
  • Password
  • Professional license number
  • Certification or credential documentation
  • Clinic or organizational affiliation

Payment Information

  • Payments are processed by third-party payment providers (e.g., Paddle or similar)
  • We do not store full credit card or banking details

Patient-Related Information (Uploaded by Practitioners)

At the sole discretion and responsibility of practitioners, the Service may process patient-related information. This information may include:

Identifying Information

  • Patient name
  • Patient email address, where the practitioner uses patient-summary email functionality
  • Date of birth, where provided by the practitioner in the patient library

Clinical and Background Information

  • Age
  • Gender
  • Ethnic origin
  • Medical condition(s)
  • Practitioner-entered clinical history and context
  • Clinical or classification information entered by the practitioner, including ICD-10 codes where used
  • Practitioner-authored treatment summaries
  • Treatment and session documentation
  • Patient-facing summary drafts and practitioner-approved summaries
  • Practitioner notes and post-treatment recommendations
  • Other information intentionally entered by the practitioner

Purpose of processing

Patient-related information is processed to provide the documentation, information-retrieval, communication and related functionality selected by the practitioner. This includes practitioner-initiated export or transfer to connected EHR systems, where enabled: such a transfer happens only because the practitioner has configured the connection and initiated the transfer, and HLISTIX sends the information to the system the practitioner has designated.

HLISTIX does not use identifiable patient information for unrelated research, advertising, or model training unless a separate lawful basis and any required permissions have been established.

Patient email

Patient email address, where provided by the practitioner, may be used to deliver practitioner-reviewed and practitioner-approved patient communications or summaries through functionality initiated by the practitioner.

Important: Hlistix does not determine what patient data is uploaded, does not validate such data, and does not control how practitioners use the information.

Communications

  • Messages, inquiries, or support requests sent to us
2.2 Information Collected Automatically
  • Usage data (features used, system interactions)
  • Technical data (browser type, operating system, IP address)
  • Cookies and similar technologies (see Section 9)

3. How We Use Information

We use information to:

  • Operate and maintain the Service
  • Authenticate users
  • Process subscriptions and payments
  • Verify practitioner credentials
  • Enable secure documentation and EHR export workflows
  • Communicate service-related updates
  • Improve performance and functionality
  • Detect misuse, fraud, or security incidents
  • Comply with legal obligations

4. Healthcare Data and HIPAA Readiness

HLISTIX may process patient-related information entered by practitioners. The architecture has been designed with privacy and security controls relevant to professional healthcare environments and with HIPAA privacy and security requirements in mind, including encryption, access controls and auditability.

  • Data is encrypted in transit and at rest
  • Access is restricted to authorized users
  • Audit logs are maintained

HLISTIX does not currently offer a HIPAA-supported deployment and does not currently enter into Business Associate Agreements with customers. Users may not use HLISTIX for PHI subject to HIPAA where such use would require HLISTIX to act as a Business Associate unless and until HLISTIX expressly enables that use under an applicable BAA.

Practitioner Responsibility

Practitioners remain responsible for determining the laws and professional obligations applicable to their practice and for obtaining any legally required rights, consents or authorizations for patient information they submit or communicate using the Service, including:

  • Determining whether uploaded data constitutes Protected Health Information (PHI)
  • Obtaining patient consent and legal authorization
  • Ensuring compliance with applicable privacy laws, applicable U.S. federal and state privacy laws, and professional regulations

Hlistix acts solely as a technology service provider and does not provide healthcare services.

5. Data Sharing

We may share information with:

  • Service providers (cloud hosting, payment processors, email services) solely for Service operation
  • Legal authorities when required by law
  • Successors in the event of a business transfer

We do not sell personal information and do not share personal information for targeted advertising.

6. Data Security

Security measures include:

  • TLS encryption for data in transit
  • AES-256 encryption for data at rest
  • Role-based access controls
  • Audit logging
  • Secure cloud infrastructure

7. Data Retention

We retain personal information for as long as reasonably necessary to provide the Service, meet applicable legal, security and operational requirements, and maintain required backups. Information is deleted or de-identified in accordance with our applicable retention practices.

  • Data is retained while accounts remain active
  • Following account closure, account and profile information is deleted or de-identified in accordance with our retention practices
  • Patient records and treatment summaries are clinical records kept for the clinic or practitioner who is responsible for them. They are not deleted when an account is closed: accounts are closed on request (see Section 8), and an account that holds or belongs to clinical records is deactivated while the records are retained for their custodian, as required by law
  • Copies may persist in encrypted backups until those backups expire under our backup retention schedule
  • Aggregated and de-identified usage data may be retained for analytics and research
  • Data required for legal compliance may be retained as required by law

8. Your Rights

Depending on your jurisdiction, you may have rights to:

  • Access
  • Correction
  • Deletion
  • Data portability
  • Restriction or objection to processing

Requests may be sent to: Ifat@hlistix.com

9. Cookies

We use:

  • Essential cookies (authentication, security)
  • Analytics cookies (where legally permitted or with consent)
  • First-party attribution cookie (hlx_il_attr, up to 90 days) on our Israel landing pages. It is a non-essential cookie: it is set only if you choose “Accept All” in our cookie banner, and it is not set (or is removed) if you choose “Essential Only”. It holds a random browser identifier and, if you arrived through a link we sent you, a random link identifier. It contains no name or e-mail address. We use it only to understand which of our own messages or sources led to a visit, a registration or a subscription. It is set by HLISTIX, is not shared with advertising networks, and we use no third-party tracking on these pages.

10. International Data Transfers

The Service is hosted on Google Cloud in Israel (Tel Aviv region) and in the United States. Account information, patient records and treatment summaries are stored in Israel; Chinese Medicine records are stored in the United States. Some service providers, such as our email delivery provider, may process limited information (for example an e-mail address and a notification message) in other countries. Information may therefore be transferred between these countries, under contractual and technical safeguards.

11. Children's Privacy

The Service is intended for professionals and is not directed to individuals under 18 years of age.

12. Updates to This Policy

Material changes will be communicated via email or in-app notice.

13. Contact Information

For privacy-related questions or concerns:

Operator: Ifat Shterenberg — Sole Proprietor (United States)
Email: Ifat@hlistix.com
Address: 303 Broadway St, Ste 104 #1073, Laguna Beach, CA 92651

Related Policies