Hank AI Privacy Policy

Last updated: September 15, 2026 · Effective: September 15, 2026 · Version 2026-09-15

In short (this summary is not part of the policy and does not modify it; if it conflicts with the text below, the text controls): We collect your sign-in identity (via SSO), and we log how you use the Service to authenticate you, meter and bill usage, and protect against abuse. We do not sell or share your personal information for advertising. Unless your organization has an executed BAA on a PHI-eligible tier, do not send PHI or patient data. We keep data only as long as we need it, host it in the United States, and honor your privacy rights.

This Privacy Policy is issued by Hank AI, Inc., a Delaware corporation ("Hank," "we," "us," or "our"), which is the controller responsible for the personal information described here. It explains how we collect, use, disclose, and protect information in connection with your use of the Hank.ai websites, applications, APIs, MCP endpoints, and related services (the "Service"). It is incorporated by reference into our Terms of Service, and capitalized terms not defined here have the meanings given in the Terms. By using the Service, you agree to this Privacy Policy.

1. Information We Collect

Account and identity information. When you sign in, we use single sign-on ("SSO") through your identity provider (for example, Google) using the standard openid email profile scope. We receive and store your email address, your name, a stable identifier (the identity provider's subject) for your Account, and, where your provider supplies them, basic profile attributes such as your profile-image URL and locale. For organization-managed accounts we may also receive your provider's hosted-domain. We never receive or store your identity-provider password.

Usage and metering information. To operate, secure, meter, and bill the Service, we record information about each interaction, including: the service and operation invoked; timestamps; request paths (with sensitive tokens and URL credentials redacted before storage); HTTP status; processing time and the request/response size of the call; the volume, unit count, and Credits associated with the call; how the interaction reached us (direct API, web interface, or our edge gateway); the API Key or session used (stored only as a non-reversible cryptographic fingerprint; we do not store the key or session token itself); your IP address; and your browser or client user agent.

Security and administrative logs. To protect the Service and maintain an integrity trail, we keep: (a) administrative audit records of changes made to accounts and configuration, which include the actor, IP address, user-agent, the action taken, and a before/after snapshot of the affected record; and (b) security-event logs of failed or blocked authentication and suspected-abuse attempts, which include the IP address, request method and path, and a non-reversible token fingerprint. We do not store raw credentials in these logs.

Content you submit. When you use a service you send us Customer Content: the queries, claims, clinical notes, documents, and other material you choose to submit. Without a signed Business Associate Agreement, the content you submit is not treated as PHI, and Hank may use it in de-identified or aggregated form to improve the Service (see Section 5). Content submitted under an executed Business Associate Agreement is handled under that agreement's HIPAA safeguards and is excluded from service-improvement use. Some services keep the content you submit so the feature can work at all (for example, chat history); others discard it after they answer. Section 8.1 says which is which and how to turn on zero data retention.

Communications. If you contact us for support, we retain your messages and contact details to respond.

Protected Health Information. The Service processes PHI only for organizations that hold a PHI-eligible subscription tier and have executed Hank's Business Associate Agreement (see Section 6 of the Terms). For every other organization, the Service is not intended or authorized for PHI or patient-identifiable data, and you agree not to submit it. PHI submitted under an executed BAA is handled under that BAA's HIPAA safeguards and is excluded from service-improvement (training) use.

2. How We Use Information

We use the information we collect to: provide, maintain, and improve the Service; authenticate you and manage your Account, Entitlements, and Credits; meter usage and calculate and process billing; detect, investigate, and prevent abuse, fraud, scraping, automated misuse of the user interface, security incidents, and violations of our Terms, and to enforce our rights (including suspending or terminating access); respond to your requests and provide support; and comply with legal obligations.

3. Legal Bases for Processing (EEA / UK)

If you are in the European Economic Area ("EEA") or the United Kingdom, we process your personal information on the following legal bases: (a) performance of a contract: to authenticate you, provide the Service, manage your Account and Entitlements, meter usage, and calculate and process billing; (b) our legitimate interests: to secure the Service; to detect, investigate, and prevent abuse, fraud, scraping, and automated misuse; to maintain administrative audit and security logs; and to improve the Service, in each case balanced against your rights; (c) compliance with a legal obligation: to meet tax, accounting, and other legal requirements and to respond to lawful requests; and (d) your consent: where we ask for it, which you may withdraw at any time. Where we rely on legitimate interests, you may object to that processing as described in Section 9.

4. How We Share Information

We do not sell or share your personal information, and we do not engage in "sharing" for cross-context behavioral advertising, in each case as those terms are defined under the California Consumer Privacy Act as amended by the CPRA. We have not sold or shared personal information in the preceding 12 months. We share information only as follows:

• Service providers and subprocessors who process information on our behalf under written contracts that limit them to providing services to us. These include our hosting and database provider, our content-delivery and security provider (which also terminates TLS for every Hank address), our payment processor, our SSO identity provider, the AI providers that power the features you use, and our email and alerting providers. The current list, with the purpose, data categories, and location of each, and which of them can receive PHI, is published at console.hank.ai/legal/subprocessors. We announce a change to that list by email to the contacts on file for each organization before a new subprocessor begins processing personal information, and business customers may object on reasonable data-protection grounds.
• Payments: Stripe, Inc. is our payment processor. You enter your card details directly with Stripe; Hank never receives or stores your card number. Stripe issues your invoices and receipts, and it processes your billing contact and payment details for its own fraud-prevention, tax, and compliance obligations.
• Legal and safety: where we believe in good faith that disclosure is required by law or legal process, or is necessary to protect the rights, property, or safety of Hank, our users, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.

5. Use of Information for AI and Model Improvement

We may use usage and metering information, and De-Identified or Aggregated Data derived from your interactions, to operate, secure, and improve the Service, including its search, ranking, and machine-learning features. We do not use the content of your individual queries to train machine-learning models that are made available to other customers except in De-Identified or Aggregated form, and we do not sell your data or use it for third-party advertising. Where we offer features powered by third-party AI providers, those providers act as our subprocessors under confidentiality and are named, with the data they receive, at console.hank.ai/legal/subprocessors.

6. Cookies and Sessions

We set a small number of first-party cookies. Each one supports a function you asked for:

• __Secure-hank_session and __Host-hcs_admin are secure, HTTP-only session cookies. They keep you signed in to the web interface and associate your web activity with your Account for authentication and metering. They expire within 12 hours.
• hank_theme records whether you chose the light or the dark appearance, so the interface looks the same on your next visit. It holds one value, light or dark, lasts one year, and contains no identifier. We store the same value in your browser's local storage so the page can apply it before it renders.

Analytics. We use Cloudflare Web Analytics to count page views and measure page performance. Cloudflare Web Analytics sets no cookie and stores no identifier in your browser; the measurement script is served from Cloudflare's network and reports to our own domain. It records the page URL, the referrer, the browser type, and coarse country-level location derived from the IP address.

We serve no third-party advertising, we do not track you across unrelated websites, and we use no advertising cookies.

7. Data Security and Breach Notification

We use administrative, technical, and organizational measures designed to protect information against unauthorized access, disclosure, alteration, and destruction, including encryption in transit, access controls, and a private internal network between Service components. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to your personal information, we will notify affected users and, where required, the relevant supervisory authority or regulator without undue delay and consistent with applicable law (including, for EEA/UK personal data, the GDPR/UK GDPR 72-hour authority-notification standard where the breach is likely to result in a risk to individuals). Our notice will describe, to the extent known, the nature of the incident, the categories of data involved, and the steps we are taking in response.

8. Data Retention

We retain personal information only as long as needed for the purposes described in this policy:

• Account and identity information: for as long as your Account exists. When your organization asks us to delete its account, we verify the request and then erase or de-identify the account, identity, and membership records within 30 days, except for the consent and billing records named below.
• Usage and metering records: a scheduled job removes the IP address, the user agent, and the credential fingerprint from usage records older than 24 months. The remaining billing columns (which service, which operation, how many credits) are kept as the billing record.
• Administrative audit records: a scheduled job deletes administrative audit records older than 24 months.
• Consent records: we keep your acceptances of these documents (which document, which version, when) for as long as we may need to prove that consent was given. If we erase your account we keep the consent record and de-identify the identifiers in it, because deleting the record would destroy the proof that you consented.
• Security-event logs: records of failed or blocked authentication and suspected abuse are written to our hosting provider's log system and are retained for that system's retention window, which is short (days, not months). Abuse signals we store in our own database are kept while the related account is active.
• Billing records held by Stripe: Stripe keeps invoice and payment records for the period its own tax and accounting obligations require. We cannot delete those records, and deleting them would not be lawful.

We may retain information longer where required to meet a legal, tax, accounting, or regulatory obligation, to resolve an active dispute, or to enforce our agreements, and we may keep aggregated or de-identified information, which no longer identifies you, indefinitely.

8.1 Zero Data Retention (optional, per service)

For services whose processing does not require keeping your input, organizations with a signed Business Associate Agreement may turn on zero data retention (ZDR) per service in the console (Account → Data retention). When ZDR is enabled for a service, we process your request and do not retain the content you submit to that service afterward (we still keep the minimal usage/metering count needed for billing, which contains no submitted content). Zero data retention is distinct from a BAA: a BAA governs how data is safeguarded if it is stored, while ZDR means it is not stored at all.

ZDR is available only for a service that can return its answer without keeping your input. Today those services are HANK Safe Harbor (de-identification), HANK Codesets (code lookup), HANK ClaimCleaner (claim scrubbing), HANK Payer Policy Manager (price transparency and policy monitoring), HANK ARSE (document extraction), and HANK Automated Medical Coding (auto-coding). Codesets, ClaimCleaner, and Payer Policy Manager are stateless lookups; Safe Harbor is a stateless transform; ARSE and Automated Medical Coding discard the input once they return the result.

ZDR is not available for a service that needs the retained content to work. Today those services are HANK Scholar, whose chat needs the conversation history to answer a follow-up question, HANK MedicalNotes, and HANK Docs. Turning retention off for one of these would break the feature you are paying for. The console's Data retention page is the authoritative list and always shows the current state of each service on your account.

9. Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, or port your personal information, or to object to or restrict certain processing. To exercise any of these rights, email [email protected] or contact us at the address in Section 16. We will verify your request using the account information we hold (for example, control of the email address on the Account) before acting, and you may use an authorized agent acting on your behalf with proof of authorization. We will respond within the time required by applicable law: generally within 45 days under the CCPA (extendable by a further 45 days with notice) and within one month under the GDPR/UK GDPR (extendable by two further months for complex requests). We will not discriminate or retaliate against you for exercising these rights, and we do not offer financial incentives in exchange for your personal information. If we decline a request, we will explain why, and you may appeal by replying to our decision. You also have the right to lodge a complaint with your local data-protection supervisory authority (EEA/UK) or with the California Privacy Protection Agency or California Attorney General.

10. California Privacy Notice (CCPA / CPRA)

This section supplements the policy for California residents. In the past 12 months we have collected the following statutory categories of personal information:

Where you submit health-related content to a service, we process it only to provide that service to you, and, where a Business Associate Agreement applies, under that agreement's HIPAA safeguards. We do not collect sensitive personal information for the purpose of inferring characteristics, we do not knowingly collect the personal information of minors, we do not sell or share personal information, and we do not use or disclose sensitive personal information beyond the purposes permitted by the CPRA (so the right to limit its use does not apply, and we do not offer a "Do Not Sell or Share" opt-out because we do neither). California residents have the rights to know, access, correct, and delete, and to be free from discrimination for exercising these rights. Exercise them as described in Section 9; we will verify and respond within the CCPA timelines.

11. Automated Decision-Making and Profiling

We use automated processes to meter usage, enforce rate and credit limits, and detect abuse, fraud, and automated misuse, which can result in throttling, a credit block, or suspension of access. We do not use these processes to make decisions that produce legal or similarly significant effects about you without a means for human review: if your access is suspended or terminated by an automated control and you believe it was in error, you may contact us at [email protected] for human review. We do not engage in profiling for marketing or advertising purposes.

12. Data Processing Addendum for Business Customers

If you use the Service on behalf of an organization and, in doing so, route personal information of your own end users or staff through the Service, you act as the controller (or business) for that information and Hank acts as your processor (or service provider) with respect to it, limited to providing the Service to you. Hank offers the Service to customers in the United States. Hank does not currently offer a Data Processing Addendum, and does not offer the Standard Contractual Clauses, for self-service accounts. An organization that requires a Data Processing Addendum must contact [email protected] about an Enterprise agreement. For protected health information, the Business Associate Agreement in the console is the governing data-protection agreement, and it is available to any organization on a PHI-eligible tier. Nothing in this policy authorizes you to submit PHI or other patient-identifiable data, which remains prohibited under Section 6 of the Terms of Service unless and until a separate Business Associate Agreement is executed.

13. International Data Transfers

The Service is operated from the United States. Hank's compute and databases run in the United States (Railway, us-east4). Object storage regions are listed on the subprocessor page. Our subprocessors are listed at console.hank.ai/legal/subprocessors with the location of each. Our content-delivery and security provider operates a global edge network, so a request you make from outside the United States is first received at an edge location near you before it reaches our United States infrastructure.

Hank offers the Service to customers in the United States and does not currently provide a transfer mechanism (such as the Standard Contractual Clauses or the UK International Data Transfer Addendum) for self-service accounts. An organization that needs one must contact [email protected] about an Enterprise agreement. If you access the Service from outside the United States, your information is transferred to and processed in the United States, where data-protection laws may differ from those of your jurisdiction.

14. Children's Privacy

The Service is a professional tool intended only for use by individuals 18 years of age or older acting in a business or professional capacity. It is not directed to children, and we do not knowingly collect personal information from anyone under 18, and in particular not from any child under 13 within the meaning of the U.S. Children's Online Privacy Protection Act. If we learn we have collected such information, or if you believe a child has provided us information, contact us at [email protected] and we will delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make a material change, we will publish the updated policy with a new version identifier and effective date and, where required, ask you to review and accept it before continuing to use the Service.

16. Contact

This Privacy Policy is issued by Hank AI, Inc., a Delaware corporation, the controller responsible for the personal information described here. For any privacy question or to exercise your rights, contact our privacy team at [email protected] or by mail at the postal address published on the Hank website. If you are in the EEA or the UK and we are required to appoint a representative or data protection officer, their contact details will be published here.

Revision History

Prior versions are available on request at [email protected]. Material changes will be published here with a new version identifier and, where required, will ask you to review and accept the updated document before continued use.