Privacy Policy

1. Who We Are

Sovereign RCM (“we,” “us,” or “our”) is a disciplined AI product company headquartered in Princeton, New Jersey. Our flagship product, Sovereign RCM, is an on-premise AI billing appliance for medical practices. This Privacy Policy applies to the Sovereign RCM website at sovereignrcm.com and the services we offer.

2. Information We Collect

Information You Provide

When you submit our contact form, we collect:

• Full name (required)
• Email address (required)
• Phone number (optional)
• Practice or organization name (optional)
• Your message or inquiry

Information Collected Automatically

We use a single, essential cookie to store your theme preference (light or dark mode). This cookie contains no personal information and is not used for tracking or advertising. We do not use localStorage or sessionStorage.

We use privacy-friendly analytics and monitoring tools to understand how visitors interact with our website and to identify errors. These tools do not set cookies, do not use localStorage or sessionStorage, and do not collect personally identifiable information. Specifically:

• PostHog: Anonymous product analytics with in-memory persistence only. No cookies are set, and no data is stored in your browser between sessions.
• Vercel Analytics and Speed Insights: First-party, privacy-friendly tools that measure page performance and visitor trends without setting cookies or collecting personal data.
• Sentry: Used for error monitoring only. Sentry captures technical error data (such as stack traces and browser type) to help us fix bugs. It does not track your browsing behavior or collect personal information.

Our hosting provider may collect standard server logs (IP address, browser type, pages visited, timestamps) for security and performance purposes. We do not use these logs for marketing or profiling.

3. How We Use Your Information

We use the information you provide through our contact form to:

• Respond to your inquiry within one business day
• Evaluate whether our services are a fit for your practice
• Schedule follow-up conversations you request
• Improve our website and services based on feedback

We do not sell, rent, or share your personal information with third parties for marketing purposes.

4. Sovereign RCM and Patient Data

Sovereign RCM is an on-premise AI appliance. It is deployed inside your practice, on hardware you own. By design:

• Protected health information (PHI) never leaves your building. All AI inference, claim drafting, and data processing happen locally on the appliance.
• Sovereign RCM does not receive, store, transmit, or have access to any patient data processed by the appliance.
• The appliance operates in a true air-gapped configuration with no cloud connectivity required for core functionality.
• Your practice retains 100% ownership and control of all data processed by the appliance.

Sovereign RCM is designed to support HIPAA compliance. Specific data handling, Business Associate Agreement (BAA) terms, and security configurations are covered in the deployment agreement between Sovereign RCM and each practice.

5. Data Sharing and Third Parties

We may share your contact information with the following categories of service providers, solely to operate our business:

• Email delivery: To send contact form submissions to our founders
• Hosting: Our website is hosted on Vercel, which processes requests to serve pages

We use privacy-friendly analytics tools (PostHog, Vercel Analytics, Vercel Speed Insights) and error monitoring (Sentry) as described in Section 2. These services process anonymous, non-personally-identifiable data on our behalf. We do not use advertising networks, social media trackers, or remarketing pixels on this website.

6. Cookies

This website uses a single cookie:

Our analytics tools (PostHog, Vercel Analytics, Vercel Speed Insights) and error monitoring (Sentry) do not set any cookies. PostHog is configured with in-memory persistence, meaning no data is stored in your browser between sessions. Vercel Analytics and Speed Insights are first-party and cookieless by design. We do not use tracking cookies, advertising cookies, or any third-party cookies. You can clear the theme cookie at any time through your browser settings; the site will default to your operating system's color scheme preference.

7. Data Security

We implement reasonable security measures to protect the information submitted through our website, including:

• HTTPS encryption for all data in transit
• Server-side form validation and spam protection
• Limited access to contact submissions (founders only)

No method of transmission over the internet is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

8. Data Retention

We retain contact form submissions for as long as necessary to respond to your inquiry and maintain the business relationship. If you would like us to delete your information, contact us at the address below and we will do so within 30 days.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Opt out of any future communications

To exercise any of these rights, contact us using the information in Section 11 below.

10. Children's Privacy

This website is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us and we will delete it promptly.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, reach out to us:

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. We encourage you to review this policy periodically. Continued use of the website after changes constitutes acceptance of the updated policy.