Legal
Hatch West, LLC dba Balance (“Balance,” “we,” “us,” or “our”) provides patient-billing, payment, communications, and administrative technology through https://usebalance.co and related applications, dashboards, payment pages, and integrations (collectively, the “Services”). This Privacy Policy explains how we collect, use, disclose, and protect information in connection with the Services.
This Privacy Policy applies to healthcare practices and other clients, billing-company users, patients and other payers who interact with Balance, website visitors, and other individuals whose information is processed through the Services. Patients, guarantors, parents or guardians, and other payers using a Balance patient-facing billing or payment experience should also review the Balance Patient Payment Terms & Privacy Notice, which provides additional patient-specific payment and privacy information. When we process Protected Health Information (“PHI”) on behalf of a healthcare provider or other HIPAA-regulated client, we generally act as a business associate under HIPAA and our Business Associate Agreement (“BAA”) governs our handling of that PHI. A healthcare provider’s Notice of Privacy Practices, not this Privacy Policy, describes the provider’s HIPAA privacy practices. This Privacy Policy is a notice of our privacy practices and does not create contractual rights or obligations beyond those provided by Applicable Law or a separate agreement with Balance.
Our Role in Processing Personal Data
Depending on the context, privacy laws may treat Balance as a controller or business that determines why and how Personal Data is processed, or as a processor, service provider, contractor, or business associate processing information on behalf of a Client. We generally act on behalf of Clients when processing patient billing, communications, payment-workflow, and related Client Data according to their instructions and applicable agreements. We generally determine the purposes of processing for our own business contact information, account administration, public-website analytics and advertising, B2B marketing, security, legal compliance, and business operations.
When we process Personal Data on behalf of a Client, the Client generally controls the underlying relationship with the individual. Privacy or HIPAA requests concerning patient or practice data supplied by a Client should generally be directed to that Client; we will assist as required by applicable law and our agreements.
1. Information We Collect
1.1 Client, Prospective Client, and Account Information
When a healthcare practice, billing company, or Authorized User creates or uses an account, or when a Billing Company Client invites a healthcare practice to use Balance, we may collect names, business contact information, job title, organization information, login and authentication information, account permissions, support communications, invitation and onboarding status, and subscription or billing information. We may receive business contact information directly from you or from a Billing Company Client or other business partner that has a relationship with you. Before an invited practice completes Balance onboarding, the invitation process is intended to use business contact and onboarding information rather than patient-level information or PHI.
1.2 Patient Billing and Healthcare Information
Healthcare practices, authorized billing companies, practice-management systems, electronic health record systems, and other authorized sources may provide us with information used for billing and payment workflows. This can include patient or guarantor name, date of birth, contact information, account or statement identifiers, provider information, balance due, charge and insurance-payment information, statement documents, payment status, and other billing-related information. Some of this information may be PHI under HIPAA.
1.3 Communications
We may process the content and metadata of billing-related text messages, emails, support messages, and other communications sent through the Services, including sender and recipient information, date and time, delivery status, opt-out status, and message content.
1.4 Payment and Transaction Information
Payments are processed through Stripe and payment methods made available through Stripe. Secure card or payment credentials are generally collected directly through Stripe-enabled components rather than stored by Balance. We may receive transaction identifiers, amount, status, date and time, payment-method type, card brand and last four digits, refund or dispute status, and similar transaction metadata needed to provide the Services. If a user chooses Affirm or another third-party payment method, that provider may collect additional information under its own terms and privacy policy.
1.5 Device, Log, and Usage Information
When you use the Services or visit our public website, we may automatically collect IP address, browser type, device and operating-system information, timestamps, pages or features used, referring pages, log information, cookie identifiers, advertising identifiers, and similar technical or interaction data. We may use cookies, pixels, tags, local storage, and similar technologies for authentication, security, preferences, functionality, analytics, campaign measurement, and B2B advertising as described below.
1.6 Information from Integrations and Service Providers
We may receive information from systems a Client connects to Balance, from Stripe and other service providers, and from vendors that help us authenticate users, deliver communications, prevent fraud, provide infrastructure, or support the Services.
2. How We Use Information
We may use information to:
provide, operate, maintain, and support the Services;
send billing statements, payment requests, reminders, confirmations, and other administrative communications on behalf of healthcare practices;
facilitate payment experiences and exchange transaction information with Stripe and other applicable payment-method providers;
authenticate users, manage account permissions, and provide customer support;
integrate with practice-management, electronic health record, billing, and other systems authorized by a Client;
provide analytics, reconciliation, reporting, and workflow automation;
use automated or AI-assisted tools for administrative functions such as classifying, summarizing, drafting, extracting, prioritizing, or analyzing information;
monitor, secure, debug, maintain, and improve the Services and prevent fraud, abuse, or security incidents;
comply with legal obligations and enforce our agreements; and
communicate with prospective or current business clients about Balance, using non-PHI business contact information where permitted by law;
market and advertise Balance to healthcare practices, billing companies, and other prospective business customers; and
measure marketing performance, recognize returning public-website visitors, retarget B2B website visitors, create custom audiences, and identify similar or lookalike business audiences using public-website activity, cookie or device identifiers, and business contact information where permitted by law.
We do not use PHI, patient or guarantor billing information, patient contact information, statement contents, or patient payment transaction data for advertising, retargeting, or audience creation, and we do not use PHI to train general-purpose artificial-intelligence models. We may use information that has been de-identified so that it no longer identifies an individual, including properly de-identified PHI, for analytics, benchmarking, security, product development, and other lawful business purposes.
3. How We Disclose Information
3.1 Healthcare Practices and Authorized Billing Companies
We disclose patient billing, communication, and transaction information to the healthcare practice responsible for the account and to billing companies or other Authorized Users that the practice has authorized to administer its Balance account.
3.2 Stripe and Payment-Method Providers
We disclose information to Stripe and other applicable payment-method providers as necessary to create or connect Stripe accounts, process payments, present payment methods, handle refunds or disputes, prevent fraud, and provide transaction reporting. Those providers process information under their own agreements and privacy notices where they act independently.
3.3 Service Providers and Subcontractors
We may disclose information to vendors and subcontractors that provide hosting, data storage, communications delivery, security, analytics, customer support, authentication, software, and other services for Balance. We require appropriate contractual protections when those parties process PHI or Personal Data on our behalf.
3.4 Client-Directed Integrations
At a Client’s direction, we may exchange information with practice-management systems, electronic health record systems, billing platforms, or other third-party integrations. The third party’s own terms and privacy practices may also apply.
3.5 Legal, Safety, and Corporate Transactions
We may disclose information when required by law or legal process; to protect the rights, safety, or security of Balance, our users, or others; to investigate fraud or unlawful activity; or in connection with a merger, financing, acquisition, reorganization, or sale of all or part of our business, subject to applicable confidentiality and legal requirements.
3.6 Advertising, Analytics, and B2B Marketing Partners
We may disclose limited public-website and business-contact information to analytics, advertising, and marketing platforms to measure campaigns, match business audiences, retarget visitors to our public B2B website, and create custom, similar, or lookalike audiences for Balance’s B2B marketing. Depending on the service, this information may include IP address, cookie or device identifiers, page views and interactions, referring information, organization or business-role information, and business email addresses or hashed identifiers. We do not provide PHI, patient or guarantor information, patient billing or statement data, or patient payment transaction data to advertising partners for these purposes.
3.7 Sale, Sharing, and Targeted Advertising
We do not sell Personal Data in exchange for money. Certain disclosures to advertising or marketing partners described in Section 3.6 may be considered a “sale,” “sharing,” or processing for “targeted advertising” under some state privacy laws even when no money is exchanged. Where an applicable law gives you a right to opt out of those activities, we will provide and honor the required opt-out choices as described in Section 8.
4. HIPAA and Protected Health Information
When Balance creates, receives, maintains, or transmits PHI on behalf of a HIPAA covered entity or business associate, our use and disclosure of that PHI is governed by HIPAA and the applicable BAA. In that role, we process PHI on behalf of the healthcare organization rather than for independent consumer-marketing purposes.
If you are a patient or other individual seeking to access, amend, obtain a copy of, or exercise another HIPAA right regarding your medical or billing record, please contact the healthcare provider identified on your statement or payment page. We may assist the provider as required by our BAA, but the provider generally controls the designated record set and responds to HIPAA rights requests.
5. Cookies and Analytics
We may use cookies and similar technologies that are necessary for login, authentication, security, user preferences, session management, and site functionality. On our public B2B website, we may also use analytics and advertising technologies, including cookies, pixels, or tags, to understand website use, measure campaigns, recognize visitors, and support B2B retargeting and audience development. We do not use advertising or retargeting technologies on patient payment pages or within authenticated product areas where PHI or patient billing information is processed. You can control many cookies through your browser settings and, where available, our cookie or privacy-choice controls, although disabling necessary cookies may prevent parts of the Services from functioning.
6. Data Retention
We retain information for as long as reasonably necessary to provide the Services, comply with legal and contractual obligations, maintain security and business records, resolve disputes, and enforce agreements. Retention periods vary by the type of information and our role. PHI is retained and deleted in accordance with the applicable BAA, Client instructions where legally permitted, backup practices, and legal obligations. Balance is not intended to be a healthcare practice’s sole medical-record archive.
7. Data Security
We maintain reasonable and appropriate administrative, physical, and technical safeguards designed to protect information from unauthorized access, use, alteration, or disclosure. With respect to ePHI, we apply safeguards required by the HIPAA Security Rule to the extent applicable to Balance. No electronic system or transmission method is completely secure, and we cannot guarantee absolute security.
8. Privacy Rights and Choices
8.1 Business Account Information
Authorized Users can update certain account information through the Services or by contacting support@usebalance.co. Business users may opt out of promotional Balance emails by using the unsubscribe mechanism in the message. We may still send transactional, account, security, and service communications.
8.2 State Privacy Rights
Depending on where you live and whether an applicable privacy law covers the information, you may have rights to request access, correction, deletion, or portability of Personal Data, and rights to opt out of certain sales, sharing, targeted advertising, profiling, or sensitive-data processing. As described above, some B2B advertising and retargeting activities involving public-website or business-contact data may be treated as a sale, sharing, or targeted advertising under applicable state law.
Where required by applicable law, you can opt out of browser-based advertising or sharing by using the “Your Privacy Choices” or cookie-settings control made available on our public website. Where required, we also honor recognized opt-out preference signals, such as the Global Privacy Control, for the browser or device sending the signal. You may also contact privacy@usebalance.co for assistance with an applicable targeted-advertising or sale/sharing opt-out. Because browser-based identifiers are device- and browser-specific, you may need to exercise the choice separately on different browsers or devices.
To exercise a privacy right relating to information that Balance controls for its own business purposes, email privacy@usebalance.co. We may need to verify your identity. If the request concerns information we process on behalf of a healthcare practice or other Client, we may direct the request to that Client or assist the Client in responding, as required by applicable law. Certain information may be exempt from a privacy request, including information governed by HIPAA or information we must retain by law.
You may appeal a denial of a request where applicable law provides an appeal right by replying to our decision or emailing privacy@usebalance.co with “Privacy Appeal” in the subject line.
9. Children and Minors
Balance business accounts are not intended for children to create or administer. However, healthcare practices may use the Services for billing relating to patients who are minors, and we may process information about minors when provided by a healthcare practice, authorized billing company, parent, guardian, or other authorized source. When that information is PHI, we process it on behalf of the healthcare practice under HIPAA and the BAA. Parents, guardians, or personal representatives seeking access to or correction of a minor’s healthcare information should generally contact the healthcare provider.
10. Third-Party Services
The Services may link to or integrate with third-party services such as Stripe, payment-method providers, healthcare systems, or other websites. This Privacy Policy does not govern information a third party independently collects or processes under its own terms. We encourage you to review the relevant third party’s privacy notices.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will post the revised version with a new “Last Updated” date. If a change materially affects how we use Personal Data, we will provide additional notice where required by law, such as email or an in-product notice.
12. Contact Us
For privacy questions or requests, contact privacy@usebalance.co. For general support, contact support@usebalance.co. For legal notices, contact legal@usebalance.co.