Privacy Policy

Dischargo ("Dischargo," "we," "us") provides a post-discharge patient monitoring platform used by hospitals and care facilities ("Hospital," "you," when we mean our direct customer). This policy explains what we collect, why, and what rights you have — whether you're a hospital administrator, a member of a care team, or a discharged patient receiving check-in messages.

1. Who this applies to, and who controls what

For patient data, the hospital is the data controller and Dischargo is the data processor — the hospital decides what patient data is collected and why; we process it on the hospital's instructions, under a Data Processing Agreement (and, for U.S. hospitals, a HIPAA Business Associate Agreement). For hospital staff accounts and our own marketing/sales activity, Dischargo is the controller.

2. Information we collect

From hospital staff: name, work email, phone number, role, and login activity.

From or about patients, on the hospital's instruction: name, phone number, discharge diagnosis or condition, medications, discharge and follow-up dates, and daily check-in responses — medication adherence, weight, pain level, and self-reported symptoms sent by WhatsApp reply. Where provided, a designated family or emergency contact's name and phone number.

Automatically: IP address and basic request metadata, captured in our audit log for security purposes — never patient health data itself.

We do not use cookies for advertising or cross-site tracking. Only the minimum session cookie needed to keep you logged in.

3. How we use this information

• Deliver the core service: sending check-in messages, receiving and recording replies, and surfacing risk alerts to the hospital's care team
• Notify a patient's designated contact when a high-severity alert fires, as configured by the hospital
• Generate the hospital's own usage and outcome reports
• Maintain the security audit log described in our Security & HIPAA overview
• Communicate with hospital staff about their account, trial status, and service changes
• Meet legal and regulatory obligations

We do not use patient health data to train machine learning models, and we do not sell personal information or patient data, ever.

4. Who we share data with

We share data only with the service providers necessary to run the platform, each bound by a written agreement:

• Supabase — database hosting (PostgreSQL)
• Meta (WhatsApp Cloud API) — delivering and receiving check-in messages
• Resend — transactional email delivery
• Paddle — billing for the hospital's own subscription; Paddle never receives patient data

We also disclose data when required by law, to enforce our terms, or to protect the rights, safety, or property of Dischargo, our customers, or patients.

5. International data transfers

We currently work exclusively with hospitals in the United States, and patient data is hosted in the United States. If we begin serving hospitals in other countries, we will do so under the safeguards described in the Data Processing Agreement executed with that hospital — including any applicable data-residency commitments — and this policy will be updated accordingly.

6. Data retention

Patient data is retained for the duration of the hospital's active engagement with Dischargo, and for a limited period after termination as agreed in the Data Processing Agreement, after which it is deleted or returned to the hospital. Hospital staff account data is retained for as long as the account is active, plus a limited period for legal and audit purposes.

7. Security

We encrypt data in transit and at rest, isolate every hospital's data at the application layer, maintain a full audit log of access to patient records, and verify a cryptographic signature on every inbound message before processing it. Full detail is in our Security & HIPAA overview, including what's built today versus still in progress — we'd rather be precise than reassuring.

8. Your rights

If you're a patient or family contact: requests to access, correct, or delete your data should go through the hospital that referred you to Dischargo, since they control that data. We'll support the hospital in fulfilling any such request.

If you're a hospital staff member or site visitor: depending on your location, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to or withdraw consent for certain processing — including under U.S. state privacy laws (e.g. CCPA). Contact us at hello@dischargo.com to exercise any of these.

9. Children's privacy

Dischargo is a clinical tool used by hospital staff on behalf of their patients, including minors where a hospital's care program requires it — always under the hospital's own consent and guardianship processes, never through direct signup by a minor.

10. Changes to this policy

We'll update the date at the top of this page when this policy changes, and notify hospital administrators directly of any change that materially affects how patient data is handled.

11. Contact

For privacy questions, data requests, or anything in this policy: hello@dischargo.com. For security-specific questions or to request our Business Associate Agreement, see our Security & HIPAA overview.