Privacy Policy

This Privacy Policy describes how SOMA AI LLC (“SOMA AI,” “we,” “us,” or “our”) collects, uses, stores, and shares information in connection with the MACS Enterprise platform, including the MACS: CM mobile application, the MACS: IW mobile application, and the MACS web application (collectively, the “Services”).

1 Who We Are, and How MACS Enterprise Works

SOMA AI LLC is an Indiana limited liability company. Contact us at privacy@somaaillc.com with questions about this Privacy Policy.

MACS Enterprise is a business-to-business service. Access is by invitation only — there is no public sign-up. The Services are used by two kinds of individuals:

• Case managers and staff (“Case Management Users”), enrolled by the case-management organization, insurer, third-party administrator, or employer they work for or with (each, a “Customer Organization”); and
• Injured workers (“Injured Worker Users”), enrolled by invitation from a case manager coordinating their workers’ compensation care.

Because MACS Enterprise operates on behalf of Customer Organizations, the Customer Organization responsible for your case controls significant aspects of your data, as described below. If you are an Injured Worker User, information in the Services may be part of the record of your workers’ compensation matter.

2 Information We Collect

2.1 Information provided by you or your Customer Organization

• Identifiers: name, date of birth, email address, and phone number. For injured workers, a claim number and, where provided by the Customer Organization, a Social Security number (stored with field-level encryption; see Section 6).
• Workers’ compensation case information: date of injury, employer, insurance carrier, claim jurisdiction, diagnosis and injury details, job classification, case status, and return-to-work information.
• Health information: information about your injury, treatment, medications, and recovery entered by you or your case manager in the course of case management.
• Visit recordings and derived content: where recording consent has been given (Section 3), audio recordings of medical visits, and the transcripts, AI-drafted clinical summaries, and medication information derived from them.
• Communications: messages exchanged within the Services, and notes, tasks, assessments, and reports created by case managers.
• Consent records: the consent version you agreed to, the applicable jurisdiction, when consent was given or withdrawn, and the consent that authorized each recording.

2.2 Information collected automatically

Device and technical information (device type, OS version, app version); usage and diagnostic information (authentication events, feature usage, error logs); and audit records of significant actions (for example, when a report is shared externally).

2.3 Device permissions

Microphone: used to record medical visits, only after the consent process in Section 3. Notifications: case-related alerts, if enabled.

3 Recording Consent

MACS Enterprise does not record any medical visit without documented consent. Before a recording can begin, the injured worker must have a current, signed recording consent on file for the applicable jurisdiction. Consent language is specific to the applicable state and versioned, and the specific consent that authorized each recording is permanently associated with that visit’s record. Consent may be withdrawn at any time in the app or through your case manager; withdrawal stops future recordings but does not un-record prior visits, which remain part of the case record.

4 How We Use Information

We use information to: provide the Services (case management, visit recording and documentation, messaging, medication tracking, reporting, and outcome analytics); generate AI-drafted transcripts, clinical summaries, and medication suggestions — all subject to review by a case manager before they are shared with the injured worker (Section 5); authenticate users and secure the platform, including audit logging; operate, maintain, and improve the Services; communicate with you about the Services; and comply with applicable law.

We do not use your information for advertising. We do not sell your information (Section 7.5). We do not permit our AI service provider to use your information to train its models (Section 7.2).

5 AI-Generated Content and Human Review

The Services use artificial intelligence to transcribe recorded visits, draft clinical summaries, and suggest medication list updates. AI-drafted content may contain errors and is not a substitute for professional medical judgment. By design, AI-drafted visit summaries are not released to injured workers until a case manager has reviewed them, and AI-suggested medications are never added to a medication list without case-manager approval. AI-generated content is not medical advice.

6 How We Store and Protect Information

Information is stored on servers operated by our cloud providers in the United States: structured case information in an encrypted database (Amazon Web Services); visit recordings and generated reports in encrypted cloud storage (Amazon Web Services); Social Security numbers, where present, additionally encrypted at the field level via a dedicated key-management service. All data in transit is encrypted (TLS/HTTPS). Case Management Users are required to use multi-factor authentication. We maintain audit logging and access controls limiting each user to the cases and organization they belong to.

We have entered into Business Associate Agreements or equivalent data-protection agreements with the service providers that process identifiable health information on our behalf, including Amazon Web Services (infrastructure), Vercel (application hosting), and OpenAI (AI processing).

No method of storage or transmission is completely secure. If you believe your account or data has been compromised, contact us immediately at privacy@somaaillc.com. We investigate reported incidents and provide notifications as required by applicable law.

7 How We Share Information

7.1 Within your case and your Customer Organization

Case managers and authorized staff of the Customer Organization handling your case can view case information within their organization. Injured workers see their own case information, including visit summaries after case-manager review.

7.2 Service providers

We share information with providers who process it on our behalf, under contracts (including BAAs where applicable) that limit their use of it: Amazon Web Services (database, storage, authentication, email, serverless processing); Vercel (application hosting); OpenAI (visit audio and related content for transcription and summary drafting — under our agreement, OpenAI does not use this content to train its models); Apple (technical information described in Apple’s own privacy policy, for the iOS apps).

7.3 Workers’ compensation participants

Where authorized by the Customer Organization and permitted or required by applicable workers’ compensation law, reports or case information may be shared with participants in the claim — for example, the employer, the insurance carrier or third-party administrator, or treating providers — limited to the minimum information necessary for the purpose of the disclosure. External report sharing occurs through expiring secure links initiated by a case manager, and each external transmission is recorded in the audit log.

7.4 Legal requirements and business transfers

We may disclose information when required by law, court order, subpoena, or government request, or to protect the safety of any person or our legal rights. If SOMA AI LLC is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction; we will provide notice before your information becomes subject to a different privacy policy.

7.5 We do not sell your information

SOMA AI LLC does not sell, rent, or trade personal information or health information to any third party for any purpose, including advertising.

8 Your Rights and Choices

• Access and correction: view your information in the apps; injured workers may ask their case manager or Customer Organization to correct case information.
• Recording consent: decline or withdraw at any time (Section 3), without losing access to other features.
• Notifications: control email preferences in Settings and device notifications in your device settings.
• Deletion: because the Services are provided on behalf of your Customer Organization and relate to a workers’ compensation matter, deletion requests are coordinated with that organization, and some records must be retained under applicable law, the organization’s retention obligations, or for the integrity of the claim record. To request deletion, contact your Customer Organization or privacy@somaaillc.com; we will honor requests to the extent permitted by law and our contractual obligations.
• State privacy rights: depending on your state of residence, you may have additional rights under state privacy laws. Certain workers’ compensation and employment records are exempt from some state privacy laws; we respond to rights requests as required by applicable law.
• Microphone access: revoke in your device settings; this disables visit recording.

9 Retention

We retain information for as long as needed to provide the Services to your Customer Organization, for the duration required by applicable workers’ compensation record-retention law, and as required by other applicable law. Audit logs and consent records are retained to preserve the integrity and defensibility of the case record. Upon termination of an Organization Agreement, data return and deletion are handled as provided in that agreement and applicable law.

10 Children’s Privacy

The Services are intended for adults 18 years of age and older. We do not knowingly collect personal information from children under 18. If you believe a child under 18 has provided personal information through the Services, contact privacy@somaaillc.com.

11 Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the Services or by email and update the “Last Updated” date above. Continued use after changes take effect constitutes acceptance.

12 Contact Us