Privacy Policy

1. Who we are

ChatterForms is a product of Neo HealthTech LLC, a California limited liability company. We provide an AI-assisted form builder, hosting, submissions, analytics, and optional HIPAA-oriented features for customers on a HIPAA-compliant plan.

2. How do we handle data

We handle information differently depending on whose data it is and why we have it.

Account and customer data

When you register, subscribe, or use the builder, we collect information about you as a Customer. We use that information to operate the product, bill you, provide support, and improve the services. For that data, we decide how it is processed (we act as a business / controller).

Form submissions (including PHI)

Answers, files, signatures, and other content that responders submit to a Customer’s form belong to the form owner (the Customer). We host and process that content so the Customer can collect it. We do not use submission data to market to responders. We do not sell it. For HIPAA-covered use, we act as a Business Associate under a BAA; the Customer is responsible for their duties as a covered entity or other regulated party.

Form submissions containing PHI are accessible to the form owner. We do not make PHI available to our staff. We do not share form submission data except with service providers needed to run the platform (for example, cloud hosting), under contracts that require confidentiality and appropriate safeguards. Where HIPAA applies, we have BAAs with those vendors, and data is encrypted.

Website visitors

If you browse our marketing sites without an account, we still collect limited usage, device, and referral information as described below, including advertising and analytics tags, so we can operate and measure the site.

3. Information we collect

From customers

• Registration details: name, email address, and password (stored as a hash)
• Billing details needed to subscribe (name, email, and payment method information handled by our payment processor—we do not store card numbers)
• Account preferences and product usage (onboarding, settings, support messages)
• API keys and credentials for integrations you choose to connect
• Form definitions you create (titles, fields, logic, styling). Your forms are treated as private unless you publish or embed them. We do not sell your forms or use responses for purposes unrelated to providing the services, except as required by law or with your permission.
• Email lists you upload to send survey invitations. We hold those addresses only as a custodian so you can invite people. We do not sell them or use them for our own marketing.

Form construction inputs

• Prompts, PDFs, images, and URLs you provide so we can generate or clone a form. These are used only to build the form. Do not include PHI in generation inputs.

From form responders

• Whatever the Customer’s form asks for. The Customer is responsible for that form and for how they use the answers. If you have questions about a form you were asked to fill out, contact the form owner. ChatterForms is not responsible for the content of a Customer’s form. Whether a response is anonymous depends on how the Customer configured the form.

Automatically collected data

• Usage data: pages viewed, clicks, timestamps, and similar interaction data when you use the services
• Device and log data: IP address, browser and device type, operating system, and approximate location inferred from IP
• Referral data: the source that sent you to our site (for example a link or ad)
• Advertising and analytics data, including cookies and click identifiers, so we can measure campaigns and site performance

4. How we use information

We use customer and visitor information to:

• Provide, secure, troubleshoot, and improve the services
• Create and manage accounts, process subscriptions, and send transactional email
• Generate form structures from customer prompts and documents
• Show form owners their submissions and analytics
• Monitor abuse, spam, phishing, and fraud
• Enforce our Terms and protect rights and safety
• Understand how the product is used (including aggregated, de-identified statistics)
• Measure marketing performance and, where permitted, send product updates

We do not use contact details collected in a Customer’s form to contact form responders for our own purposes. We do not sell personal information. We may share aggregated or de-identified statistics that do not identify individuals.

5. PHI, HIPAA, and AI

No PHI is routed to any AI model. AI is used only to construct forms—not to process or analyze submitted PHI. You control what you generate and publish. AI output can be imperfect; review it before you publish.

We do not put PHI in emails. Respondents access forms via the form URL or a secure link.

Customers who need HIPAA-covered handling enable HIPAA on the form and subscribe to a HIPAA-compliant plan. A Business Associate Agreement is signed when you sign up for that plan and remains available at /billing. The BAA governs PHI for that covered usage.

6. Security

• Encryption in transit and at rest
• Additional protections and key management for HIPAA-enabled forms
• Payment card data is handled by our payment processor; we do not store card numbers
• Internal monitoring of key actions such as form access, submissions, and publishing

More detail is on our Security page.

7. Cookies and similar technologies

We use cookies, local storage, and similar technologies to:

• Keep you signed in and remember product drafts and preferences
• Measure site usage and advertising conversions
• Help protect signup against bots

Emails we send (or that you send through the services, such as survey invitations) may include signals that help measure delivery and opens. You can block cookies in your browser; some features may not work fully.

8. Service providers

We use trusted vendors to operate the services. They receive information only as needed to perform work for us, and they are required to keep it confidential and use it only for that work. Examples include:

• Cloud hosting, storage, and infrastructure providers
• Email delivery and transactional messaging providers
• Payment processors (subscriptions and optional in-form payments)
• AI providers used only to construct forms from customer inputs
• Security, fraud-prevention, and bot-protection providers
• Advertising and web analytics partners

If you connect a third-party tool (for example scheduling, messaging, or a website plugin), that provider processes data under its own terms based on what you connect. We do not own those services.

9. Sharing and legal requests

We may disclose information:

• To service providers as described above
• If required or permitted by law, or in response to a valid legal process (such as a subpoena or court order). We review requests and aim to produce only what is required
• To protect our rights, your safety, or the safety of others
• If ownership of the business changes (merger, acquisition, or reorganization), so the successor can continue providing the services
• With your direction or consent (for example when you enable an integration)

10. Form responders

If you submitted a ChatterForms-powered form, the Customer who published it decides what to ask and how to use your answers. Ask them about their privacy practices. We treat submission data as private unless the Customer has made the form public. We will not sell responder information or use it to contact you for ChatterForms marketing.

11. Communications

We send transactional messages that are part of the service (verification, password reset, billing, form published or deleted, submission notices you enable). You cannot opt out of these if you want the related feature.

We may send occasional product or marketing email if you have an account. You can unsubscribe using the link in those emails, where provided.

12. Retention

We keep account data while your account is active and as needed to provide the services, comply with law, and enforce our agreements. After you cancel, forms remain accessible for a limited period (about 30 days) so you can export, then may be deleted. Submissions are retained until the form owner deletes them or the account is closed, subject to backups and legal holds. You can export submissions as CSV from the product. Inactive accounts may be closed after a prolonged period of non-use.

13. Your rights

Depending on where you live, you may request access, correction, deletion, or a copy of personal information we hold as a business, or to opt out of sale or sharing of personal information. We do not sell personal information. We use advertising and analytics technologies as described above; you may use browser controls and industry opt-out tools, or email us.

California residents have additional rights under the CCPA/CPRA. To exercise rights, email privacy@chatterforms.com. We will verify the request. These rights apply to account and marketing data we control. Requests about form submissions should generally go to the form owner; we can assist the owner as their processor or Business Associate.

14. Where data is processed

Neo HealthTech is based in California, United States. We process information in the United States using cloud infrastructure. If you access the services from another country, you understand that your information may be transferred to and processed in the United States, which may have different data-protection rules than your country.

15. Children

The services are intended for adults. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact privacy@chatterforms.com and we will delete it.

16. Changes

We may update this policy. The “Last updated” date will change. Material changes may also be noted in the product or by email.

17. Contact

Privacy requests: privacy@chatterforms.com
Legal notices: legal@chatterforms.com

Neo HealthTech LLC
California, United States