Privacy Policy

01Overview

Penna ("Penna," "we," "us") requests, chases and organizes medical records and bills for law firms and, on request, medical providers and insurance agencies. We request records and bills from medical providers and keep them in one place, and for law firms we prepare cited medical chronologies under the direction of their attorneys. This policy explains what information we handle, how we use and protect it, and the choices you have. It covers our website at pennarecords.com and the services we provide under a signed agreement. It does not change any term of a services agreement, data protection agreement or business associate agreement between us; where those agreements say something different, they control.

02Website information and patient records

We handle two very different kinds of information, and we treat them differently.

• Website and contact information is what you share when you browse the site, request a trial, or write to us. This policy governs that information.
• Patient records are the medical and billing content inside the case materials our clients authorize us to request, and they often contain protected health information. We handle them under the agreement we sign with the client before any records move, and that agreement, not this policy, sets the rules for them. Section 06 explains how that works.

03Information we collect

Information you give us

• Contact details, such as your name, firm or organization, email address, and phone number.
• Case materials our clients send us after our agreement is signed, which may include medical records, billing records, and signed authorizations. These often contain protected health information.
• Messages, questions, and support requests.

Information collected automatically

• Basic, aggregated usage data, such as which pages are viewed and general device and browser information, gathered through cookieless analytics.

We do not run advertising trackers, and we do not sell or rent information to anyone.

04Cookies and tracking

Our marketing site is built to work without tracking cookies. We use cookieless analytics that count visits without identifying you or following you across other sites, so there is no tracking-cookie banner to click through. The Penna Portal is not open to clients yet. When it opens, signing in will use a strictly necessary session cookie to keep you logged in, never an advertising cookie.

05How we use information

• To retrieve, organize, and summarize records and deliver the chronologies you request.
• To communicate with you about your account, your cases, and support requests.
• To operate, secure, and improve the service.
• To meet our legal, regulatory, and contractual obligations.

We use patient records only to perform the services in our agreement with the client, and for no other purpose. Patient records never go to an outside AI service.

06Our agreements and HIPAA

Before any records move, we sign an agreement with the client. That agreement sets the rules for how we handle the records, and it controls if anything in this policy appears to conflict with it.

• Law firms. We sign a confidentiality and data protection agreement with your firm before any records move. Plaintiff firms are usually not HIPAA covered entities, so that agreement, rather than a business associate agreement, sets our duties to your firm.
• Medical providers. We sign a HIPAA business associate agreement before any patient data moves.

07How we share information

We do not sell information, and we share it only as far as the work requires:

• With service providers that help us run the business, such as website hosting, email and payment processing, under confidentiality and data protection terms. A service provider that holds patient records does so only under a business associate agreement signed before the records reach it.
• With the client who engaged us, as part of delivering the work.
• When the law requires it, or to protect the rights, safety, and integrity of the service.

Where patient records sit today

• In Google Workspace, under the business associate agreement we accepted with Google on 17 September 2026.
• Until the Penna Portal opens to clients, we deliver work through a secure shared folder for each firm in that Google Workspace.
• The Penna Portal will run on Google Cloud. Its business associate agreement is confirmed in writing before any patient data is stored there.
• Fax, through Sinch, goes live only after its business associate agreement is signed and fax storage is turned off.
• Patient records never go to an outside AI service.

08How we protect information

• Encryption of stored data, and of data sent over the internet where the receiving system supports it. Fax and postal mail fall outside that encryption.
• Access limited to the people who need it to do the work.
• When the Penna Portal opens, each firm will see only its own cases, and every view and download will be logged.
• Administrative, physical, and technical safeguards matched to the sensitivity of the information.

No system is perfectly secure, but we work to protect information using safeguards consistent with our obligations, and we hold our service providers to the same standard. Where patient records are involved, our safeguards are also those set out in our agreement with the client.

09How long we keep information

We keep information for as long as we need it to provide the service and to meet our legal and contractual obligations, then delete it. Handling, retention and disposal of patient records follow our agreement with the client.

10Your privacy choices and rights

Depending on where you live and your role, you may have the right to access, correct, or delete certain information, or to object to some uses. Because we do not sell information or use it for targeted advertising, there is nothing to opt out of on that front. Requests that involve patient records run through the client and our agreement with them. To make a request, contact us using the details in section 13, and we will respond as the law requires.

11Children's privacy

Penna is a service for law firms (and, on request, medical providers and insurance agencies), not for the general public, and our site is not directed to children. We do not knowingly collect information from children through the website. Medical records we handle for a case may relate to a person of any age, including a minor; those records are governed by our agreement with the client, not by this section.

12Changes to this policy

We may update this policy as our practices or the law change. When we do, we will revise the date at the top and, where appropriate, give additional notice.

13Contact

Questions about this policy can be sent to hello@pennarecords.com, or through our contact page.