Privacy Policy
Effective date: August 31, 2026 · InherisAI, Inc.
This Privacy Policy explains how InherisAI, Inc. (“Inheris,” “we,” “us”) collects, uses, shares, and protects information when behavioral‑health providers use the Inheris provider portal and related services (the “Services”). It applies to the people and practices we work with to deliver and pay for care — not to patients or clinical records.
1. Information we collect
Information you provide. Account details (email address and/or phone number, password); identity and credentialing information (name, National Provider Identifier, professional license, and federal tax identifier); practice information; bank and payment details you connect to receive payment; and the content of your communications with us.
Information from third parties. To verify your credentials and eligibility, we obtain information from public and authoritative sources, including the NPPES NPI registry, the OIG List of Excluded Individuals/Entities, the System for Award Management (SAM.gov), and state licensing boards. To verify your bank account, we use Plaid (see Section 3).
Information collected automatically. Limited technical and security information, such as log and device data, used to operate and secure the Services.
2. How we use your information
- To verify your professional credentials and eligibility to participate;
- To pay you for care you deliver, and to keep records of those payments;
- To operate, maintain, secure, and improve the Services;
- To communicate with you about your account, verification, and payments;
- To comply with legal, tax, audit, and anti‑fraud obligations.
3. Bank account verification through Plaid
We use Plaid Inc. (“Plaid”) to verify the bank account into which you choose to be paid. When you connect an account, you sign in to your bank through Plaid; Inheris never receives your bank login credentials. Plaid provides us the account and routing number needed to send you payments by ACH, and confirms that the account belongs to you.
Your use of Plaid is governed by Plaid’s End User Privacy Policy. By connecting an account, you agree that Plaid may collect, use, and share your information as described there.
4. How we share information
We do not sell your personal information. We share it only as needed to run the Services:
- Service providers that operate our infrastructure and features, principally Amazon Web Services (hosting) and Plaid (bank‑account verification), under obligations to protect it;
- The InherisAI Mental Health Fund, Inc. (our affiliated 501(c)(3)), for the purpose of funding and recording your payments;
- As required by law or to protect the rights, safety, and security of Inheris, providers, or others;
- In connection with a business transfer, subject to this Policy.
5. How we protect your information
We protect your information with encryption in transit (TLS) and at rest, strict role‑based access limited to authorized personnel using multi‑factor authentication, and audit logging. Particularly sensitive fields — including bank and payment details and tax identifiers — carry an additional layer of application‑level encryption. These measures are described in our internal Information Security Policy.
6. Data retention and deletion
We retain your information only as long as necessary for the purposes above and to meet legal, tax, and audit obligations, and then we delete it. Provider identity and credentialing records, and records of payments, are generally retained for up to seven years after the end of our relationship or your last payment. Bank and payment details are retained while you are eligible to be paid and removed promptly upon off‑boarding or a verified deletion request, subject to any legal hold. Deleted data ages out of our encrypted backups as they cycle. We review these practices at least annually.
7. Your privacy rights and choices
You may request to access, correct, or delete your personal information, subject to legal retention obligations, by contacting us at the address below. We will verify your request and respond within a reasonable time. Depending on where you live, you may have additional rights under applicable data‑protection laws; we honor those rights where they apply.
8. No patient or clinical information
The provider portal is not used to collect patient health information. Any recipient information you see through the Services is de‑identified before it reaches Inheris, and clinical details are not recorded.
9. Children’s privacy
The Services are intended for professional providers and are not directed to children. We do not knowingly collect personal information from children.
10. Changes to this Policy
We may update this Policy from time to time. When we do, we will revise the effective date above and, where appropriate, notify you.
11. Contact us
Questions or privacy requests: irv@staff.inherisai.com.
InherisAI, Inc. is a Delaware corporation. Behavioral health services are delivered by independent, licensed providers; Inheris does not provide clinical care.