Privacy Policy

Effective date: October 25, 2026  |  Last updated: October 25, 2026

Yisro Systems LLC ("Yisro," "we," "us," or "our") provides revenue intelligence software for healthcare organizations, including the Yisro Portal and the Jethro analyst assistant (together, the "Services"). In this Privacy Policy we explain what information we collect, how we use and protect it, who we share it with, and the choices you have. This Policy covers our website at yisro.com and the Services.

1. Our role and whose data this is

We handle two kinds of information, and our role differs for each.

• Customer Data. Our customers (healthcare providers, home care agencies, skilled nursing and assisted living operators, billing organizations and similar businesses) connect their own systems to Yisro. The data that flows in from those systems, including PHI, belongs to the customer. We process it only on the customer's behalf and under the customer's instructions, our agreement with the customer, and the BAA.
• Yisro Account and Website Data. We decide how to handle information about our own website visitors, prospective customers, and the people who hold user accounts on the Services (for example, names, work emails, and login activity). This Policy governs that information directly.

2. Information we collect

2.1 Information from connected systems (Customer Data)

When a customer authorizes a connection, we receive data from systems such as electronic health records and care platforms, practice management and billing systems, clearinghouses, accounting systems, and bank accounts. Depending on the customer's configuration, this may include:

• Patient and resident identifiers, demographics, insurance and eligibility information, and authorization records
• Scheduling, visit, encounter and service records, including procedure, diagnosis and billing codes
• Claims, charges, remittance advice (ERA/835), explanations of benefits, denials and adjustments
• General ledger, accounts receivable, accounts payable, and other accounting records
• Bank deposit and transaction details used to match payments to deposits

Our integrations are read-only by default. We do not write data back to a customer's source systems unless the customer expressly enables a feature that does so.

2.2 Information you give us

• Contact details when you book a demo, email us, or sign up (name, work email, phone, organization, role)
• Account information (user credentials, role and permission settings, preferences, Portal layouts)
• Questions you ask Jethro, files you upload, and feedback or support requests
• Billing contact and invoicing details for paying customers

2.3 Information collected automatically

• Device and log data (IP address, browser type, operating system, pages and features used, timestamps, referring URL)
• Security and audit logs that record access to and activity within the Services, as HIPAA requires
• Cookies and similar technologies, described in Section 13

3. How we use information

We use Customer Data only to provide, maintain, secure and support the Services for that customer, as permitted by the BAA and our customer agreement. That includes:

• Reconciling scheduling, billing, payer remittances and bank deposits, and calculating the figures the customer has defined
• Answering users' questions through Jethro and generating reports, files, dashboards and scheduled deliveries
• Troubleshooting, monitoring the health and security of the Services, and preventing misuse
• Meeting legal obligations

We use Yisro Account and Website Data to operate our website, respond to inquiries, manage accounts, send service and security notices, send product updates (you can opt out of marketing email at any time), and improve our products.

What we do not do. We do not sell personal information or PHI. We do not use PHI for marketing. We do not share personal information for cross-context behavioral advertising. We do not use Customer Data to train general-purpose AI models, and we do not permit our AI providers to do so. We may create de-identified data only in accordance with HIPAA's de-identification standard (45 C.F.R. § 164.514) and only where the BAA permits it.

4. Jethro and AI processing

Jethro, our analyst assistant, uses large language models provided by Anthropic, PBC. When a user asks Jethro a question, we send the question and the minimum data context needed to answer it to Anthropic for processing. We have a Business Associate Agreement with Anthropic covering this processing. Anthropic does not use our customers' inputs or outputs to train its models.

We design Jethro to calculate figures from the customer's approved definitions and to show the date each figure is current to. AI-generated explanations can still contain errors, so users should review results before relying on them for billing, clinical, financial or legal decisions.

5. How we share information

We share information only in these circumstances:

• With the customer and its authorized users. Users see only the data their organization's administrators permit.
• With service providers that host, process or support the Services for us, under written contracts that require confidentiality and security, and under a BAA wherever PHI is involved (see Section 6).
• With integration partners at the customer's direction. When a customer connects a system, we exchange data with that system's vendor as the customer authorizes.
• For legal reasons. To comply with law, subpoena, court order or other legal process, or to protect the rights, safety and security of our customers, users, patients, the public, or Yisro. Where the law allows, we will notify the affected customer before disclosing its Customer Data.
• In a business transfer. If Yisro is involved in a merger, acquisition, financing or sale of assets, information may transfer as part of that transaction, subject to this Policy and to any BAA in force.

6. Service providers and Business Associate Agreements

We maintain Business Associate Agreements with every service provider and integration partner that may create, receive, maintain or transmit PHI in connection with the Services. These include providers of cloud hosting and infrastructure, AI language model processing, electronic health record and care platforms, clearinghouse and claims processing, billing systems, and accounting systems. Each of these agreements requires the provider to safeguard PHI as HIPAA requires and to use it only to perform services for us.

Customers can request our current list of subprocessors by writing to support@yisro.com.

7. How we protect information

We run an information security program built around the HIPAA Security Rule and the SOC 2 Trust Services Criteria (security, availability, confidentiality, processing integrity and privacy). Our safeguards include:

• Encryption. We encrypt data in transit with TLS 1.2 or higher and at rest with AES-256.
• Access control. We apply least-privilege, role-based access, require multi-factor authentication for our personnel and support single sign-on for customers, and review access regularly.
• Read-only integrations. We request the narrowest scopes each connection needs and store integration credentials in a managed secrets vault.
• Tenant isolation. We logically separate each customer's data from every other customer's data.
• Logging and monitoring. We keep audit logs of access to PHI and monitor our environment for suspicious activity.
• People and process. Our workforce completes HIPAA and security training, signs confidentiality agreements, and follows documented incident response, risk assessment, vendor management, backup and disaster recovery procedures.
• Hosting. We host the Services in Google Cloud data centers in the United States.

No system is perfectly secure. If you believe you have found a security vulnerability, please report it to support@yisro.com.

8. Payment card data

We do not store full payment card numbers on our systems. When a customer pays us by card, a PCI DSS-validated payment processor collects and handles the card data directly. Where Customer Data from connected systems includes any cardholder data, we handle it in line with the PCI DSS and restrict, mask or exclude it from the Services.

9. Retention and deletion

We keep Customer Data for as long as the customer's subscription is active and as the BAA and customer agreement allow. When a subscription ends, we return or delete Customer Data as the customer agreement and BAA require, typically within 30 to 90 days, except where law requires longer retention or where return or destruction is infeasible, in which case we continue to protect the data and limit further use. Backups age out on a fixed schedule. We keep HIPAA-required documentation for at least six years. We keep account and website data for as long as needed for the purposes in this Policy, then delete or de-identify it.

10. Your rights and choices

Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy of it, to correct it, to delete it, and to opt out of certain processing. California residents have these rights under the California Consumer Privacy Act as amended by the CPRA, and residents of other states have similar rights under their state laws. We do not sell or share personal information as those laws define it, and we will not discriminate against you for exercising your rights.

To make a request, email support@yisro.com. We will verify your identity before acting and respond within the time the law requires. You may use an authorized agent. If we deny your request, you may appeal by replying to our response.

These state privacy rights generally do not apply to PHI governed by HIPAA, and when we hold your information as a customer's service provider, we will refer your request to that customer.

11. Information for patients

If you are a patient or resident of one of our customers, your healthcare provider controls your health information and its Notice of Privacy Practices describes your HIPAA rights, including rights to access, amend and receive an accounting of disclosures. Please direct requests to your provider. If you contact us, we will forward your request to the right provider and help that provider respond.

12. Breach notification

If we discover a breach of unsecured PHI, we will notify the affected customer without unreasonable delay and no later than the deadline in the BAA, and in all cases within 60 days of discovery, as HIPAA requires. We will provide the information the customer needs to meet its own notification duties. For other personal information, we will provide notice as applicable state law requires.

13. Cookies and analytics

Our website and the Services use strictly necessary cookies for sign-in, security and session management. On our public marketing website we may also use privacy-respecting analytics to understand how visitors use the site. We do not place advertising or tracking technologies inside the authenticated Services, and we do not send PHI to analytics or advertising vendors. You can block or delete cookies in your browser settings; blocking necessary cookies may prevent the Services from working. We honor Global Privacy Control signals.

14. Children

We build the Services for businesses, not for children. We do not knowingly collect personal information from children under 13 through our website or accounts. Any information about minors in Customer Data reaches us only as PHI on behalf of a customer and receives the protections described above.

15. Where we process data

We store and process Customer Data in the United States. We do not transfer PHI outside the United States without the customer's written consent.

16. Changes to this Policy

We may update this Policy from time to time. We will post the new version here with a new "Last updated" date, and for material changes we will notify customer administrators by email or in the Services before the changes take effect.

17. Contact us

Yisro Systems LLC
Attn: Privacy Officer
15502 Stoneybrook West Parkway, Ste 104-149
Winter Garden, FL 34787
Phone: 877-77-YISRO (877-779-4776)
Email: support@yisro.com