Jubilee Health
Join the waitlist
The networkWho it's forWhat it doesSecurity
Account
Sign in Join the waitlist

Legal

Privacy Policy

Last updated: October 23, 2026

Jubilee Health, Inc. ("Jubilee Health," "we," "us," or "our") respects the privacy of the individuals and organizations we work with. This Privacy Policy describes how we collect, use, disclose, and protect information in connection with our website at jubilee-health.com and its subdomains (the "Site") and the Jubilee Health software platform made available at app.jubilee-health.com and any other address from which we operate it, including the workspaces we provide to medical practices, accounting firms, management services organizations, IT providers, and billing companies, together with the related support services (collectively, the "Services").

This Privacy Policy is organized by audience. Section 2 applies to visitors to the Site. Sections 3 through 8 apply to our Customers and their Authorized Users. Sections 9 through 17 apply to everyone.

1. Definitions and Our Role

1.1 Definitions. In this Privacy Policy:

  • "Customer" means an organization that has agreed to our terms for the use of the Services, including a medical practice and any counterparty that a practice invites to the Services, such as its accounting firm, management services organization, IT provider, or billing company.
  • "Authorized User" means an individual whom a Customer has authorized to access the Services on its behalf.
  • "Customer Data" means information that a Customer or its Authorized Users submit to the Services, or that we retrieve from a Connected Service at a Customer's direction, including Protected Health Information.
  • "Connected Service" means a third-party system that a Customer connects to the Services at its own direction, such as its accounting, electronic health record, payroll, patient-communication, or payment system.
  • "Personal Information" means information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular individual.
  • "Protected Health Information" or "PHI" has the meaning given to it under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA").

1.2 Our role with respect to Customer Data. We collect and process Customer Data solely on behalf of our Customers. Each Customer owns its Customer Data and determines the purposes for which it is processed. We act as the Customer's service provider and, with respect to PHI, as its business associate under a Business Associate Agreement. Our processing of Customer Data is governed by our agreements with the Customer, including the applicable Business Associate Agreement, and by this Privacy Policy; where they conflict with respect to Customer Data, the Customer agreement controls. If you are a patient or an employee of a Customer, please direct any request concerning your information to that Customer, as described in Section 12.2.

1.3 Our role with respect to other information. We are the party responsible for Personal Information collected through the Site and for the account information of Authorized Users.

2. Privacy for Site Visitors

2.1 Information we collect. The Site collects Personal Information at one point only: the waitlist form, through which you may provide your name, your organization, your work email address, and the role you hold. We do not use advertising trackers or third-party analytics cookies on the Site, and we do not place Personal Information in URLs. We measure page views and waitlist signups using aggregate, cookie-free measurement.

2.2 How we use it. We use the information you submit through the waitlist form to contact you about our pilot program as capacity becomes available, and for no other purpose. We do not sell it, share it with advertisers, or add you to any mailing list you did not request.

2.3 Where it is stored and for how long. Waitlist submissions are stored in access-controlled storage on Google Cloud in the United States and retained until you ask us to delete them or the pilot program closes.

2.4 Product images. Product screenshots displayed on the Site are taken from a demonstration environment containing synthetic data. No Protected Health Information exists on the Site.

3. Privacy for Customers and Authorized Users: Information We Collect

3.1 Information you provide to us. When a Customer establishes an account or an Authorized User is added, we collect the individual's name, email address, and role. When you sign in with Google or Microsoft, that provider confirms your identity to us and we receive your email address and confirmation that it has been verified; we do not receive or store your password with that provider. When you sign in with an email address and a password set with us, the password is stored only as a one-way hash, and sign-in requires a one-time code. A Customer's administrators control which individuals have access to the Services, in which role, and may remove access at any time.

3.2 Customer Data we receive from Connected Services and uploads. The following categories of Customer Data reach us only because a Customer connects a system, authorizes a connection within its own account with the relevant vendor, or uploads an export it has chosen to provide. The Customer determines what to connect and when, and may disconnect at any time.

  • Accounting data from QuickBooks Online. When an administrator of the Customer's QuickBooks Online company authorizes the connection, we retrieve, for that company: the company name and settings; the chart of accounts; the Profit and Loss statement, Balance Sheet, and Statement of Cash Flows by month; and General Ledger transaction detail consisting of date, transaction type, reference number, payee or vendor name, memo, account, and amount. We request only the accounting scope. Customer-name fields are removed when the data is received and are not stored. Memo text is retained because the Services' ledger review depends on it; because a memo could identify a patient, we handle memo text as if it were PHI, as described in Sections 5 and 7.
  • Patient billing, claims, and encounter data from the Customer's electronic health record. A Customer may export this data from its electronic health record and provide it to us, or may authorize a connection to its electronic health record vendor under the Customer's own authorization with that vendor, through which we retrieve the categories below and nothing more. This data is PHI and is processed by us as the Customer's business associate. It consists of:
    • billed service lines: a medical record number assigned by the Customer and the patient's date of birth; the date of service, location, and visit type; procedure codes, modifiers, diagnosis codes, and units; the attending, billing, and referring provider; the primary and secondary payor; and the financial detail of the line, including charge, allowed amount, insurance and patient payments, adjustments, and outstanding balance;
    • claims: the claim identifier, its status and history, and any hold, edit, or denial reason, together with the billing notes recorded on the claim by the Customer's staff, its billing service, or the vendor's own rules ("claim notes");
    • insurance coverage: the payor and plan, the member and group identifiers, the patient's relationship to the policyholder, the order of coverage, and the effective dates and eligibility status of the coverage; and
    • referrals and authorizations: the referral or prior authorization number, the payor, the referring provider, the services and units authorized, and the dates and number of visits the authorization covers.
    To attach these records to the right patient within the Customer's own data, a connection may also return the patient's name, sex, address, and telephone number; we use those fields only to match records and do not store them. Claim notes are free text that could identify a patient, and they are held under the same controls as all other PHI and are not transmitted to the AI service. This data does not include Social Security numbers, email addresses, or any clinical note, image, or laboratory result.
  • Employee payroll data from the Customer's payroll system. From an export the Customer provides, or through a read-only connection to its payroll provider that the Customer authorizes, we receive: employee name, job title, and department; employment status and hire and termination dates; and compensation by pay period, including gross and net pay, hours worked, salary and hourly lines, paid time off, employer taxes, benefits, and reimbursements. We retain only fields on an explicit permitted list; any field outside that list is discarded before storage, and storage is refused if a prohibited field is present. Social Security numbers, dates of birth, home addresses, telephone numbers, and email addresses are removed before storage, and the reasons an employee gives for time off are not collected. The Customer is responsible for informing its employees of this use.
  • Patient communications data. Where a Customer authorizes a connection to its patient-communications system, we retrieve call logs and appointment records for the Customer's own analysis, and we may prepare draft messages that the Customer's staff review and send from that system. We do not send messages to patients. A patient's mobile telephone number and consent to receive text messages are not shared with third parties for marketing purposes.
  • Payment information. Where a Customer uses a payment feature, the payment processor receives the patient's name, the amount, and an invoice reference, and no information concerning diagnosis or treatment. We do not collect or store payment card numbers or bank account numbers.
  • Files and records. Files that a Customer or its Authorized Users upload for the purposes described above, such as statements, registers, and schedules, and the notes and approvals that Authorized Users record within the Services.

3.3 Information we collect automatically. For security and access review, the Services record, for each request: the time, the signed-in email address, the action, the resource requested, whether the request was allowed or denied, a request identifier, and the source network address. These logs do not contain credentials, session cookies, QuickBooks data, or the contents of any record. The Services use a strictly necessary session cookie to keep an Authorized User signed in; the Services do not use advertising or third-party analytics cookies.

3.4 Information we do not collect. We do not collect payment card numbers, bank account numbers, or Social Security numbers. We do not receive the passwords you hold with Google, Microsoft, Intuit, or any Connected Service; sign-in and authorization are delegated to those providers. We do not store patient names or patient contact details (Section 3.2 describes the limited use of those fields to match records), we do not collect clinical notes, images, or laboratory results, and the Services are not used to make or influence any clinical decision about a patient. We do not purchase information about you from any third party.

4. How We Use Information

We use the information described in Section 3 for the following purposes:

  • to provide, operate, maintain, and secure the Services, including displaying a Customer's own operational and financial information to its Authorized Users and to the counterparties the Customer has invited, within the scope the Customer sets;
  • to make changes to a Customer's books of account only where the Customer has authorized those changes in a signed Ledger Restructuring Authorization, as described in Section 7;
  • to identify claims that may be held or denied before they are submitted, and, only where a Practice has signed an EHR Write Authorization as described in Section 7.3 of our End User License Agreement, to add a claim note or attach a document to a claim in the Practice's electronic health record after a named member of the Practice's staff has approved that specific note or document; we do not create, submit, or delete claims, and we do not change codes, charges, or clinical content;
  • to produce de-identified, aggregated statistics, including benchmarks shown to other Customers, as described in Section 6.4;
  • to authenticate Authorized Users, enforce each Customer's roles and access scopes, and detect, investigate, and prevent unauthorized access and other security incidents;
  • to provide the artificial intelligence features described in Section 5;
  • to respond to support requests and to send notices concerning the Services, including changes to this Privacy Policy; and
  • to comply with applicable law and our agreements with Customers.

Patient-level records are used in aggregate; an individual record is displayed only when an Authorized User opens the records underlying a figure. We do not sell, rent, or trade Personal Information or Customer Data, we do not use it for advertising, and we do not use it to train machine-learning models.

5. Artificial Intelligence

5.1 The AI features. Certain features of the Services use Claude, an artificial intelligence assistant operated by Anthropic PBC, to answer questions submitted by Authorized Users, to review how ledger entries are categorized, to draft operational recommendations and reports, and to model scenarios (the "AI Features"). Output of the AI Features is decision support for Authorized Users, is labeled as AI-generated within the Services, and does not modify any Connected Service: a suggested change is a proposal that a person reviews.

5.2 Information transmitted to the AI service. When an AI Feature runs, the following is transmitted to Anthropic: (a) accounting data from QuickBooks Online, consisting, for each account, of its name, category, number of postings, and total, together with up to six sample postings (vendor, memo text limited to ninety characters, and amount) after entries that appear to refer to a patient have been removed, and figures that the Services have computed from the Customer's own reports; (b) payroll and staffing summaries, consisting of roles, hours, overtime, and compensation totals; (c) de-identified practice statistics derived from billing data, consisting of counts and totals by month, payor, provider, procedure, and diagnosis, in which any statistic that would describe fewer than eleven patients is combined with others before transmission; and (d) the Customer's operating calendar, consisting, for each day the practice was open, of the number of visits, the amount billed, and the number of providers working, with no visit linked to any patient.

5.3 Information not transmitted. No OAuth tokens, credentials, or QuickBooks company identifiers are transmitted. No patient names, medical record numbers, dates of birth, individual dates of service, or per-patient records of any kind are transmitted; the AI Features are not given access to that data. Because a memo line could still identify a patient notwithstanding the screening described above, we treat memo text as if it were PHI: it is held under the same controls as PHI, it is transmitted only after screening, and our agreement with Anthropic prohibits Anthropic from using it to train models or for any purpose of its own and limits its retention. We are putting a Business Associate Agreement with Anthropic in place for our production environment so that this data is also covered by one; this Privacy Policy will be updated when it is.

5.4 Training, retention, and logging. Anthropic does not use information transmitted by the Services to train its models, and we do not permit Anthropic to use it for any purpose of its own. Under our agreement with Anthropic, inputs and outputs are deleted within thirty days, or sooner where zero-retention processing is configured. Every request to the AI Features is recorded in the access log described in Section 3.3, identifying the Authorized User and the time. Every figure displayed in the Services is drawn from the records we hold rather than from the AI service. If we change the categories of information transmitted to the AI service, we will update this Privacy Policy before doing so and notify affected Customers.

6. How We Share Information

6.1 Service providers. We engage a limited number of service providers to host and operate the Services. Each processes information only on our instructions and under a written agreement containing data-protection and confidentiality terms at least as protective as this Privacy Policy. A service provider that may process PHI does so under a Business Associate Agreement, subject to Section 5.3 with respect to memo text. We do not authorize our service providers to use or disclose Personal Information or Customer Data for their own purposes. Our service providers are:

  • Google Cloud Platform (Google LLC): application hosting, data storage, secret storage, and logging, in the United States (us-east4), under a Business Associate Agreement;
  • Google LLC and Microsoft Corporation: sign-in and identity verification only;
  • Anthropic PBC: the AI Features, for the information described in Section 5 only, under terms that prohibit training on the data and any use for Anthropic's own purposes; a Business Associate Agreement is being put in place as described in Section 5.3; and
  • Mailgun (Sinch): delivery of invitation and notification email. Messages contain links and do not contain patient or financial detail.

6.2 At the Customer's direction. Customer Data is disclosed to the following recipients only as a Customer directs: (a) the providers of the Customer's Connected Services, each of which receives from us only what the function requires, and a Connected Service that carries PHI operates only under the Customer's Business Associate Agreement with that provider and with us; and (b) the counterparties the Customer invites to the Services, such as its accounting firm, management services organization, IT provider, or billing company, which may view the Customer's information within the Services, within the scope the Customer sets, and which are bound by the terms of use and by their own obligations to the Customer.

6.3 Legal requirements and protection of rights. We may disclose information where we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request, or is necessary to protect the rights, property, or safety of Jubilee Health, our Customers, or others, consistent with applicable law and our agreements with Customers.

6.4 De-identified and aggregated information. We may create and use de-identified, aggregated statistics derived from Customer Data, including in benchmarks shown to other Customers. De-identification follows the standard set out in the applicable Business Associate Agreement, no published figure is derived from fewer than eleven underlying records, and we do not attempt to re-identify de-identified information. No Customer's data is disclosed to another Customer except in de-identified, aggregated form.

6.5 Business transfers. If Jubilee Health is involved in a merger, acquisition, financing, reorganization, or sale of all or substantially all of its assets, information may be transferred as part of that transaction, subject to the same commitments made in this Privacy Policy and in our agreements with Customers, and we will provide notice to Customers before their information becomes subject to a different privacy policy.

6.6 No sale. We do not sell Personal Information or Customer Data, and we do not share it with third parties for their own marketing or advertising purposes.

7. QuickBooks Online Data

7.1 What we read and what we write. We read the QuickBooks Online data described in Section 3.2 solely to provide the functionality of the Services to the Customer and its invitees. We make no change to a Customer's QuickBooks Online company unless the Customer has executed a separate written Ledger Restructuring Authorization, under which we may set up the standard chart of accounts in a new or empty company or convert an existing chart of accounts to it by adding, renaming, renumbering, and inactivating accounts, repointing income accounts, recategorizing transactions, and posting reclassifying journal entries. We do not delete transactions, we do not merge accounts, and we do not write memo text or customer information to QuickBooks Online. Each change is approved by a named individual, recorded with its prior and subsequent state, and may be reversed at the Customer's request.

7.2 No third-party access. We do not provide any third party with access to a Customer's QuickBooks Online data by API or by any other means. No raw QuickBooks data, no credential, and no export leaves the Services. The counterparties described in Section 6.2 view, within the Services, figures that the Customer has elected to share with them. Anthropic receives the figures and ledger samples described in Section 5.2, for the Customer's own requests, as our processor. We do not export, save, or store QuickBooks Online data for any purpose other than the functionality of the Services for the Customer and its invitees. Any submission of a Customer's figures to an industry survey is made by the Customer, not by us. We do not sell QuickBooks Online data and do not use it to train any model.

7.3 Independent parties. We do not process information on behalf of Intuit Inc., and Intuit does not process information on our behalf. Each of us independently determines the purposes and means of the processing it carries out. Intuit's handling of a Customer's QuickBooks Online data is governed by Intuit's Global Privacy Statement. Intuit does not enter into Business Associate Agreements, which is why we do not write memo text or customer information to QuickBooks Online. Intuit and QuickBooks are registered trademarks of Intuit Inc. Used with permission.

8. Protected Health Information

PHI that we receive from or on behalf of a Customer is received and maintained by us as the Customer's business associate under a Business Associate Agreement, is used and disclosed only as that agreement and HIPAA permit, and is subject to the administrative, physical, and technical safeguards required by the HIPAA Security Rule. We apply the minimum-necessary standard to the roles, access scopes, and automated processing within the Services. Where this Privacy Policy and a Business Associate Agreement differ with respect to PHI, the Business Associate Agreement controls. Patients' rights with respect to their health information, including rights of access, amendment, and an accounting of disclosures, are exercised through the Customer that provides their care, and we assist the Customer in responding as the Business Associate Agreement requires.

9. Cookies and Tracking Technologies

The Site sets no advertising or analytics cookies and uses no third-party advertising services. The Services use a strictly necessary session cookie to maintain an Authorized User's signed-in session; it is not used for tracking across other sites and is not shared with third parties. Because we do not sell or share Personal Information, a Global Privacy Control signal transmitted by your browser is honored and results in no change to our practices.

10. Data Retention

We retain information for as long as necessary to fulfill the purposes described in this Privacy Policy, to perform our agreements with Customers, and to comply with our legal obligations, as follows:

  • Customer Data is retained for as long as the Customer uses the Services and for thirty days after its use ends, so that the Customer may export its data in a machine-readable format, after which it is deleted. PHI is returned or destroyed as the applicable Business Associate Agreement provides, within sixty days of termination.
  • QuickBooks Online data and authorization tokens are retained until the Customer disconnects QuickBooks Online or asks us to remove them. Upon disconnection, we cease retrieving data and delete the stored tokens and the QuickBooks Online data we have retrieved.
  • Information transmitted to the AI service is deleted by Anthropic within thirty days under our agreement, or sooner where zero-retention processing is configured.
  • Access logs are retained for a limited period appropriate to security review, currently thirty days. Audit records of access to Customer Data are retained for the period our compliance program requires, not exceeding six years.
  • Waitlist submissions are retained until you ask us to delete them or the pilot program closes.

A deletion request from a Customer, or a request relayed to us by a Connected Service provider such as Intuit on the Customer's behalf, is carried out by removing the data from our systems; once the hosting platform's short recovery window, measured in days, has elapsed, the data cannot be recovered. We confirm deletion in writing upon request. Information received by us in error is returned or deleted and is not used. De-identified, aggregated information may be retained indefinitely.

11. Security

We maintain administrative, physical, and technical safeguards designed to protect information against unauthorized access, use, or disclosure, including the following:

  • all traffic is encrypted in transit, and data at rest is encrypted by the hosting platform;
  • access is denied by default: every page and interface of the Services refuses any request that does not carry a valid session belonging to an Authorized User, removing an Authorized User ends that individual's sessions, and password sign-in requires a one-time code;
  • authorization tokens for Connected Services, including QuickBooks Online refresh tokens, are held encrypted in a managed secret store readable only by the Services' own service account, and are never written to application disk or source code;
  • the Services run in a hardened, minimal container as a non-privileged user with a read-only file system and a service account restricted to the secrets it requires;
  • each Customer's data is held in its own segregated, encrypted store, every access to Customer Data is logged as described in Section 3.3, and logs never contain credentials or QuickBooks Online data; and
  • the QuickBooks Online connection conforms to Intuit's published security requirements for applications, and we permit Intuit's periodic security review.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting a Customer's information, we will notify the Customer without unreasonable delay and within the time required by its Business Associate Agreement with us, provide the information the Customer needs to notify affected individuals, and notify any Connected Service provider within the time its terms require. Where applicable law entitles you to notice from us directly, we will provide it. Security concerns may be reported to security@jubilee-health.com.

12. Your Choices and Privacy Rights

12.1 Requests. You may request access to the Personal Information we hold about you, request its correction or deletion, or request that your access to the Services be removed, by writing to privacy@jubilee-health.com from the email address you use with us. A Customer may at any time disconnect a Connected Service, export its Customer Data, and narrow or revoke the scope of any counterparty's access. We will respond to a verifiable request within forty-five days of its receipt, or within such shorter period as applicable law requires.

12.2 Patients and employees of a Customer. We hold Customer Data on the Customer's behalf and act on the Customer's instructions. If you are a patient or an employee of a Customer, please direct any request to access, correct, or delete your information to that Customer, which remains responsible for it; we will carry out the Customer's instructions as our agreements require.

12.3 State privacy rights. Depending on where you reside, you may have the right under applicable state law to know the categories of Personal Information we collect and the purposes for which we use it, to access and obtain a copy of your Personal Information, to correct inaccurate Personal Information, to delete your Personal Information, to limit the use of sensitive Personal Information, to opt out of the sale or sharing of Personal Information, and not to be discriminated against for exercising these rights. We do not sell or share Personal Information, and we do not use or disclose sensitive Personal Information for purposes other than those permitted by applicable law. To exercise these rights, submit a verifiable request as described in Section 12.1. An authorized agent may submit a request on your behalf if the agent provides proof of written authorization and we are able to verify your identity. We comply with the privacy and breach-notification laws of the District of Columbia, Maryland, and Virginia and with the federal laws described in this Privacy Policy.

12.4 Marketing communications. We do not send marketing communications. We send notices concerning the Services, including notices of changes to this Privacy Policy, to the administrative contacts of our Customers.

13. Children's Privacy

The Site and the Services are intended for use by businesses and their personnel and are not directed to children. We do not knowingly collect Personal Information from anyone under the age of eighteen. If we learn that we have collected such information, we will delete it.

14. Data Location and International Transfers

Information is stored and processed in the United States, on Google Cloud, in a storage location dedicated to each Customer. The Services are offered in the United States. We do not knowingly collect Personal Information from residents of the European Economic Area or the United Kingdom, and we do not transfer information outside the United States.

15. Third-Party Websites and Services

The Site and the Services may contain links to, or integrate with, websites and services operated by third parties, including the Connected Services a Customer elects to use. Those websites and services are governed by their own terms and privacy policies, which we encourage you to review. We are not responsible for the privacy practices of third parties.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The revised policy will be posted at this address with a new "Last updated" date. Material changes, including any change to the categories of information we collect or to the information transmitted to the AI service, will be communicated to Customers before they take effect, and to any Connected Service provider whose terms require notice of such changes. Your continued use of the Site or the Services after a change takes effect constitutes acceptance of the revised Privacy Policy.

17. Contact Us

Questions, requests, or concerns regarding this Privacy Policy or our privacy practices may be directed to:

Jubilee Health, Inc.
Attention: Privacy
Email: privacy@jubilee-health.com
Security: security@jubilee-health.com
Legal notices: legal@jubilee-health.com

See also our End User License Agreement.