Privacy Policy.

This Policy covers personal information about website visitors, prospective customers, account holders, authorized users, and individuals communicating with Glazco in connection with ReportRocket. "Personal information" means information that identifies, relates to, describes, or can reasonably be associated with an individual, as defined by applicable law. The Services are designed for healthcare professionals and organizations, rather than for patients to obtain medical advice directly.

For business-contact and website information that we determine how and why to process, Glazco generally acts as the organization responsible for those decisions. For clinical information handled under an agreement with a hospital, radiology practice, or other healthcare customer ("Customer"), we process that information in accordance with the Customer's instructions, an applicable BAA, and the law. The Customer ordinarily remains responsible for its own medical records, patient communications, and privacy notices.

Depending on your relationship with ReportRocket and the functions you use, information may include:

• Identity and account information: name, email address, workplace or practice affiliation, account identifiers, authentication status, and information provided to or returned by Microsoft Entra External ID. Password entry and identity verification for Microsoft-hosted sign-in occur through Microsoft's identity service rather than a password form operated by the ReportRocket marketing website.
• Business communications: inquiries, support correspondence, requests for documentation, feedback, and information voluntarily included in communications with Glazco.
• Clinical workflow content: dictated audio, transcribed text, report drafts, findings, proposed impressions, report edits, instructions, and information passed to or from connected reporting systems. Clinical workflow content may contain PHI when provided in an authorized healthcare setting.
• Technical and usage information: request times, approximate device and browser characteristics, network and IP-related data visible to hosting services, software version, error or diagnostic information, service requests, and operational measurements used to provide, protect, and troubleshoot the Services.
• Workstation data: local application preferences, interface settings, sign-in preferences, and certain locally stored usage metrics or diagnostic information. These items are not the same as audio recordings or the text of a completed clinical report, although a workstation may also hold information through connected software or user-directed exports.

Not every category is collected in every interaction. We do not require patients to open ReportRocket accounts in order for clinicians to use the software.

Information can be received directly from you, from the organization that authorizes your account, through the ReportRocket software and its service connections, from Microsoft Entra External ID during authentication, from Azure hosting and operational systems, or from communications with our personnel. Customers control the clinical inputs they provide and the systems to which they choose to transfer final reports. When you submit information concerning other individuals, you or your organization must have an appropriate legal basis and authority to provide it.

Glazco handles personal information for legitimate purposes connected to operating ReportRocket, including to:

• create and administer accounts; authenticate users; manage access; and communicate about the Services;
• receive dictation and other authorized inputs; provide transcription, report organization, editing, optional AI-assisted impressions, and related outputs;
• support authorized integrations, including sending completed report text to connected reporting software when initiated or configured by the user;
• operate, secure, diagnose, maintain, and improve the reliability of the Services, including reviewing operational and usage information;
• provide customer assistance, respond to requests, administer business relationships, and supply requested security information;
• prevent misuse, investigate security events, enforce agreements, and comply with legal, regulatory, and contractual obligations; and
• communicate relevant service, account, security, and policy updates.

Where privacy law requires a particular legal basis, that basis may include performance of a contract, legitimate operational or security interests, compliance with law, or consent where required. PHI is used and disclosed only as authorized by the applicable BAA and law. This Policy does not authorize Glazco to use PHI for unrelated advertising.

ReportRocket is a Windows application that works with a local backend on the user's computer. In supported AI workflows, the local backend sends authorized requests through a Microsoft Azure Gateway, and the Gateway communicates with OpenAI for transcription and AI-assisted reporting functions. Audio may be held temporarily in application memory as it is captured and transmitted for processing. Transcribed speech and report content are processed to produce the requested report drafts, revisions, and impressions.

The desktop application and its local components may maintain user preferences and certain diagnostic or usage information on the workstation. Workstation-controlled files, connected PACS environments, PowerScribe One, and any reports exported or saved by the user remain subject to their respective systems, settings, and organizational policies. The handling of audio, transcripts, report content, logs, backups, and provider-side copies depends on the applicable workflow, technical configuration, agreements, and retention requirements; no universal zero-retention or automatic-deletion period is promised by this Policy.

OpenAI provides AI-related processing used by ReportRocket's reporting and speech features. The inputs sent for a requested function can include dictated audio, transcribed text, instructions, clinical findings, and the context needed to generate the requested result. Outputs can include transcriptions, structured reports, edits, and impression suggestions. The applicable services, agreements, and configurations govern provider-side processing, retention, and permitted uses.

This Policy does not grant Glazco permission to use PHI or confidential Customer report content to train or fine-tune models for unrelated purposes. Any additional use of such content must have an independent lawful basis and comply with the applicable Customer agreement and BAA. We do not make a blanket representation that every provider interaction is zero-retention or that every service and configuration has identical model-training restrictions. Licensed clinicians remain responsible for reviewing clinical outputs before use.

ReportRocket uses Microsoft Azure infrastructure for the website and cloud gateway, and Microsoft Entra External ID supports account sign-in and identity management. Other Azure components can support secrets handling, operational monitoring, diagnostics, and networking. Information handled by these systems may include account-related information, authentication events, gateway requests, and operational metadata necessary to deliver or support the Services.

Microsoft's processing is governed by the service terms, configurations, and applicable agreements. Glazco maintains healthcare-related contractual arrangements with Microsoft and OpenAI, including BAAs. Such agreements do not alone establish that every service, feature, or Customer deployment is covered or that all regulatory obligations have been satisfied.

We may disclose information, as appropriate to its nature and consistent with applicable law and agreements, to:

• Service providers acting for Glazco: including Microsoft Azure, Microsoft Entra External ID, and OpenAI, to enable hosting, authentication, AI processing, diagnostics, security, and support;
• Your healthcare organization and authorized users: to administer accounts, deliver requested results, and support the Customer's reporting workflow and responsibilities;
• Customer-selected connected systems: including PACS or reporting products such as PowerScribe One, when ReportRocket's integrations and user actions cause information to pass to those systems;
• Professional advisers and business service providers: when reasonably necessary to support lawful business operations and under applicable confidentiality duties;
• Government authorities or other parties: when required by valid legal process or as necessary to protect rights, safety, systems, and legal interests; and
• Successors in a transaction: in a merger, financing, restructuring, acquisition, or sale of assets, subject to relevant confidentiality, legal, and contractual restrictions.

Information is not made publicly available simply because it is processed through ReportRocket. PHI disclosures remain limited by HIPAA and any applicable BAA.

Website hosting and related infrastructure may receive ordinary technical information associated with visits, such as IP address, browser details, requested pages, and timestamps. The current website uses Google-hosted font resources; loading those fonts can cause a browser to contact Google's services and share routine request information with Google. The website's Microsoft Entra sign-in process also directs users to Microsoft's identity service, which may use its own cookies and other authentication technologies under Microsoft's policies.

During website authentication, temporary transaction information used to complete the authorization-code flow is stored in the browser's session storage. The browser-based authentication code does not itself require visitors to enter their Microsoft account passwords into a ReportRocket-owned form. Browser preferences, identity-provider cookies, and third-party technology behavior are subject to their respective controls. You may adjust browser settings to restrict optional storage, though doing so can affect authentication or functionality.

Glazco designs its Services to limit unauthorized access and protect the integrity of information processed through them. The architecture uses account-based authentication for protected gateway functions and HTTPS connections for the application-to-gateway and gateway-to-provider pathways. Operational safeguards also involve software configuration, access management, monitoring, and appropriate organizational procedures.

Security is a shared responsibility. Healthcare Customers are responsible for securing their workstations, accounts, connected networks, PACS and reporting products, and personnel access. No information system can be guaranteed completely free of security vulnerabilities or incidents. Our Security & Trust Center explains our security approach and how organizations may request further information.

Retention varies by information type, purpose, service configuration, Customer agreements, and legal requirements. For example, account and business records can be needed for an ongoing relationship or legal obligations, operational records can be used for security and troubleshooting, and workstation preferences or local usage metrics can persist on a user's device. Reports transmitted to an organization's reporting systems may be retained under that organization's own medical-record policies.

Where Glazco processes PHI under a BAA, retention, return, destruction, and incident-related obligations are governed by that agreement and applicable law. Third-party processing and any associated logs or backups are subject to relevant provider terms and configurations. Upon a valid request or termination, we address applicable access, correction, retention, and deletion obligations under the governing agreement and law. We do not represent that all copies are erased immediately or on a uniform schedule.

The Services use external cloud and AI providers, and information may be processed or accessed in jurisdictions determined by the relevant services, configurations, and lawful support operations. This Policy does not promise that all information remains in a particular U.S. state, country, or cloud region. Where transfer restrictions apply, Glazco will address applicable legal and contractual requirements, including the requirements of any controlling BAA or data-processing agreement.

Depending on your residence, the information involved, and the law that applies, you may have rights to request access to, correction of, or deletion of personal information; to receive information about certain disclosures or processing practices; to object to or restrict some processing; to withdraw consent where processing is based on consent; or to appeal a decision about a privacy request. Some laws also provide rights relating to sales, targeted advertising, or qualifying automated profiling. These rights are subject to statutory exceptions and identity or authority verification. Glazco will respond in the manner and time required by the applicable law and will not unlawfully discriminate against an individual for exercising a privacy right.

To make a request involving your ReportRocket account or business-contact information, contact your organization's designated ReportRocket representative or use the established support channel for your account. Written requests may also be addressed to Glazco Technologies LLC, care of its registered agent, at the address listed in the official public business-entity records of its state of formation. Include sufficient information to identify your request and a safe method for responding. Do not include PHI in an ordinary privacy inquiry.

If your request concerns a patient's medical record or PHI handled by a hospital, radiology practice, or another healthcare Customer, contact that healthcare organization or its privacy office. That organization ordinarily determines how to respond to individual patient-rights requests under HIPAA. Glazco supports Customer obligations as required by the applicable BAA and law and may refer requests to the appropriate Customer. An ordinary ReportRocket account or website privacy request is not a substitute for requesting records from a treating provider.

We may use professional contact information to respond to inquiries, provide requested materials, send operational announcements, and maintain business relationships. If optional promotional messages are offered, recipients may use any opt-out mechanism provided with those communications or contact the representative who sent them. Certain service, legal, or security communications may still be necessary for an account or contractual relationship.

ReportRocket is a professional healthcare documentation service and is not directed to children. Glazco does not design the website or account registration process for individuals under 18 to establish consumer accounts. Patient information, including information about children when lawfully supplied in a clinical workflow, is handled under the applicable healthcare Customer's instructions, BAA, and privacy law—not as a direct-to-child website relationship.

Glazco may update this Policy to reflect changes in law, technology, operations, or privacy practices. The current version will be posted on this website with an updated effective date. Where required by applicable law or a binding agreement, we will provide additional notice or obtain consent before a material change takes effect. A revised Policy does not retroactively authorize a use or disclosure prohibited when the information was collected.

Glazco Technologies LLC is the company that develops and operates ReportRocket. For questions about this Policy, privacy rights, or vendor documentation, contact your designated ReportRocket representative or the support channel provided through your existing business relationship. Formal written privacy correspondence may be sent to Glazco Technologies LLC, care of its registered agent, using the address published in the official state business-entity records. Please do not send patient information through general inquiries.

This Policy should be read together with the ReportRocket Terms of Service and the Security & Trust Center. An executed BAA or other controlling healthcare or enterprise agreement prevails on matters within its scope, and applicable law controls where it cannot be waived.