Privacy Policy

Effective 3 October 2026

This policy explains what Impression Systems LLC ("we", "us") collects, why, and what you can do about it. It covers this website and the services we provide to clients. If you're a client, your signed agreement, and for a health practice our Business Associate Agreement (BAA), also apply. Where they differ from this page, they control. The Impression app has its own privacy notice inside the app, with more detail on what the app stores.

What we collect

• Website. Framer, our site host, records basic technical information (such as IP address, browser type and pages visited) to run and secure the site and to give us visit statistics. We don't use advertising trackers.
• When you contact us. Your name, email address and what you tell us. Please don't email us patient information or account numbers.
• Client work. The business data a client gives us access to under their written agreement, such as bank and card statements and, for practices on Jane, the day's schedule. For a health practice this can include protected health information, which we handle only under a signed BAA.

How we use it

To respond to you, deliver and support the services we've agreed to, keep systems secure, and meet legal obligations. We don't sell or rent personal information, share it for advertising, or use it to train AI models.

Who we share it with

Only service providers that help us run this website and our services, under terms that limit how they use it, and when the law requires. Today those are:

• Framer (website hosting) and Google Fonts (site typography)
• Cloudflare (domain name service and email forwarding) and Google Workspace (email)
• Amazon Web Services (the client app's sign-in, storage, hosting and AI through Amazon Bedrock, in the United States)
• Anthropic and OpenAI (AI services we use in our own internal work; we never send them protected health information)

Protected health information goes only to services covered by a Business Associate Agreement. Today that is Amazon Web Services, under the BAA we've signed with Amazon. See How we use AI.

Do Not Track

We don't track visitors across other websites, so we don't change our practices in response to browser Do Not Track signals.

Health information

For health practices, we sign a BAA before handling any protected health information, and handle it only as that agreement and HIPAA allow. Their app and records run on Amazon Web Services. For now, a person reviews health practices' statements instead of AI, and only totals reach the app's Money view.

Security

Sign-in to the client app always requires multi-factor authentication. Each client's data is kept apart, and requests for another client's data are refused. Stored files are encrypted at rest, and earlier versions are kept. A separate audit log records every read and write of stored records. No system is perfectly secure.

If something goes wrong

If a security incident affects your information, we'll notify you as the law and our agreements require. For a health practice, we report breaches of unsecured protected health information and other security incidents to the practice without unreasonable delay, within the time our BAA with that practice sets.

How long we keep it

• Emails you send us: while they're needed for our conversation and business records. Ask and we'll delete them, unless the law requires us to keep them.
• Client data: for as long as the engagement runs. When it ends, we return or delete it as the agreement states. For a health practice, we return or destroy protected health information as our BAA with that practice says.
• Server logs for the client app: 400 days, then deleted automatically.
• Security audit log: six years.

Your choices

You can ask to access, correct or delete personal information we control. Email us and we'll respond within 45 days. We won't treat you differently for asking. If your request is about records a health practice holds, please contact the practice. They control those records, and we'll help them respond under our agreement.

Children

Our site and services are for businesses and aren't directed at children under 13.

Changes

We'll post changes here and update the date above.

Contact

Impression Systems LLC, a Maryland limited liability company · nick@impressionsystems.co