Privacy Policy

Guardrail operates as a Business Associate under the Health Insurance Portability and Accountability Act (“HIPAA”) and the Health Information Technology for Economic and Clinical Health (“HITECH”) Act when processing Protected Health Information (“PHI”) on behalf of healthcare organization customers. PHI that our customers submit to the Services is governed by the Business Associate Agreement (“BAA”) executed with each covered-entity or business-associate customer, and is not governed by this Privacy Policy. This Privacy Policy does not apply to PHI processed under a BAA.

This Privacy Policy addresses:

• information about the individuals who administer customer accounts and interact with our platform (“Account Users”);
• information collected through our website from visitors; and
• information collected in connection with our assessment and platform services that does not constitute PHI covered by a BAA.

This Privacy Policy does not address the handling of patient information, which is governed by the applicable BAA, nor does it address the handling of Substance Use Disorder records under 42 C.F.R. Part 2, which is governed by the applicable BAA and applicable law.

When an organization registers for our Services, purchases a Discovery Assessment, or creates an account, we collect information about the organization and the individuals who register on its behalf, including, but not limited to:

• Organization name, type, and Tax Identification Number (TIN);
• Contact information, including names, titles, email addresses, and telephone numbers of account administrators and designated contacts;
• Billing information, including payment method details (processed by our third-party payment processor; we do not store full payment card numbers);
• Account credentials (username and hashed password);
• Executed agreements, including the Benchmark Contribution Agreement and Business Associate Agreement; and
• Communications with Guardrail, including support tickets, emails, and meeting notes.

When Account Users access and use the Services, we automatically collect certain technical and usage information, including, but not limited to:

• Log data, including IP addresses, browser type and version, operating system, pages accessed, and timestamps;
• Session and usage data, including features used, reports accessed, and actions taken within the platform;
• Device information, including device type, device identifiers, and network information; and
• Cookies and similar tracking technologies, as described in Section 6 of this Privacy Policy.

In connection with performing the Services, including certain assessment services, we collect information provided by customers to configure and initiate assessments, including, but not limited to:

• Organizational structure information, including department names, user group descriptions, and user counts;
• Lists of Authorized Users designated for inclusion in a Discovery Assessment or Intelligence Assessment (by name and email address);
• Information about the customer's known AI tool environment, including tool names, use cases, and deployment contexts; and
• Responses to assessment intake questionnaires.

To the extent any assessment input data constitutes PHI, it is governed by the applicable BAA and not this Privacy Policy.

When the Browser DLP Extension is installed on Authorized User devices, it monitors browser-level data flows for the purpose of detecting potential PHI exposure in AI tool interactions. The Extension:

• Analyzes data inputs and outputs within AI tool interfaces accessed through the browser;
• Identifies patterns consistent with PHI exposure risks;
• Transmits flagged findings to Guardrail's platform for analysis and reporting; and
• Does not record or transmit full browsing history, personal browsing activity unrelated to AI tool usage, or data from non-AI-tool browser sessions.

Information collected by the Browser DLP Extension related to PHI is governed pursuant to the applicable BAA. Non-PHI technical data collected by the Extension is handled under this Privacy Policy.

When you visit our website at trustguardrail.com, we collect standard web analytics information including IP addresses, pages visited, referral sources, and browser information through cookies and analytics tools. We use this information to understand website performance and improve our online presence.

• To create and maintain customer accounts;
• To configure, deliver, and administer assessment services;
• To generate assessment reports, PHI Exposure Scores, and benchmark positioning data;
• To provide technical support and respond to inquiries;
• To communicate with customers about their assessments, findings, and account activity; and
• To facilitate findings calls and follow-up consultations.

We use de-identified and anonymized Assessment Data, in accordance with the executed Benchmark Contribution Agreement (the “BCA”) and Section 5 of this Privacy Policy, to develop and maintain the RADAR Behavioral Health AI Benchmark Dataset and related industry benchmarks and indices.

• To analyze usage patterns and improve the Services;
• To develop new features, assessments, and service offerings;
• To refine the RADAR scoring methodology and assessment accuracy; and
• To conduct internal research and quality assurance.

• To process payments and manage billing;
• To comply with our legal obligations;
• To protect the security and integrity of our Services; and
• To enforce our Terms of Service and other agreements.

With Account Users' consent or as otherwise permitted by applicable law, to send communications about Guardrail's services, industry developments, regulatory updates, and educational content. Account Users may opt out of marketing communications at any time.

Guardrail's Benchmark Contribution Program converts Assessment Data into de-identified Benchmark Data through a process designed to meet or exceed the de-identification standards established under 45 C.F.R. § 164.514(b) (Safe Harbor) or 45 C.F.R. § 164.514(a) (Expert Determination), as applicable. Prior to inclusion in the Benchmark Dataset, Guardrail removes or transforms all direct and indirect identifiers that could reasonably be used to identify an individual patient, an Authorized User, or Customer's organization.

Benchmark Data includes aggregated, anonymized risk scores, exposure patterns, AI tool usage categories (not specific tool names where disclosure could identify an organization), PHI exposure rate distributions, and similar statistical outputs. Benchmark Data does not include organization names, TINs, geographic data at a granularity that could identify an organization, or any information that could be used to reconstruct PHI.

Guardrail uses Benchmark Data to generate industry benchmarks, market indices, and comparative analysis for use in: (a) assessment reports provided to Customers; (b) research and educational publications; (c) regulatory comment filings; and (d) commercial offerings provided to insurance carriers, investors, and other third parties. Guardrail's right to use Benchmark Data survives termination of the customer relationship and termination of this Privacy Policy.

Customers' participation in the Benchmark Data program is governed by the Benchmark Contribution Agreement executed at checkout or account registration. The BCA controls in the event of any conflict between the BCA and this Section 4.

We share information with third-party service providers who perform services on our behalf, including, but not limited to:

• Payment processors (to process subscription and assessment fees);
• Cloud infrastructure and hosting providers (to host and operate the platform);
• Email and communication service providers (for account and findings communications);
• Analytics and monitoring tools (for platform performance and security); and
• Customer support software providers.

We require service providers to maintain appropriate confidentiality and security protections for information shared with them and to use such information solely for the purpose of performing services on Guardrail's behalf.

Aggregated, anonymized and de-identified Benchmark Data may be shared with insurance carriers, managing general underwriters, program administrators, research institutions, regulatory bodies, and other third parties for the purposes described in Section 4.3 of this Privacy Policy.

We may disclose information when required to do so by applicable law, court order, subpoena, or other legal process, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Guardrail, our customers, or the public.

If Guardrail is involved in a merger, acquisition, sale of assets, change of control, or other business transaction, customer information may be transferred as part of that transaction, subject to confidentiality obligations and applicable law.

We may share information with third parties with the express written consent of the applicable Customer or Account User.

We retain account and registration information for the duration of the customer relationship and for a period of three (3) to five (5) years thereafter, or as required by applicable law or the applicable BAA.

Assessment reports, PHI Exposure Scores, and associated findings are retained for a period of three (3) years after delivery, after which they are deleted or archived in anonymized form. Retention of PHI in assessment data is governed by the applicable BAA.

De-identified and anonymized Benchmark Data is retained indefinitely, as it cannot be used to identify any individual or organization and constitutes a separate, aggregated dataset that is part of Guardrail's proprietary intellectual property.

Non-PHI technical data collected by the Browser DLP Extension is retained for the duration of the applicable assessment engagement and for ninety (90) days thereafter for quality assurance purposes. PHI-related findings are handled pursuant to the applicable BAA.

Web analytics and log data from website visits is retained for up to twenty-four (24) months and then anonymized or deleted.

Account Users may request a copy of the personal information Guardrail holds about them in their individual capacity. Requests may be submitted to support@trustguardrail.com.

Account Users may request correction of inaccurate personal information. Account Users may also update certain information directly through their account settings.

Account Users may request deletion of their personal information, subject to Guardrail's legal obligations and contractual commitments. Deletion of account information may result in termination of access to the Services. Requests to delete PHI are handled pursuant to the applicable BAA.

Account Users may opt out of receiving marketing communications from Guardrail at any time by clicking the unsubscribe link in any marketing email or by contacting us at support@trustguardrail.com.

Residents of certain states, including California and other states with comprehensive consumer privacy laws, may have additional rights regarding their personal information. Please contact us at support@trustguardrail.com for information about state-specific rights. Note that this Privacy Policy applies to information collected in Guardrail's capacity as a business-to-business service provider, and certain consumer privacy law frameworks may not apply to the information we process under BAAs.