Consumer Health Data Privacy Policy

Effective October 4, 2026

Foyer is a general call-screening service. A caller may nevertheless volunteer an appointment, provider, prescription, or other health-related detail. This policy explains how we handle that information.

1. Health-related data we may receive

Depending on what a caller says, a transcript, voicemail, live-decision request, or your reply may contain information that identifies a consumer's past, present, or future physical or mental health status; diagnosis or treatment; appointment, provider, medication, or health service; or payment for care. A transcript or summary may derive the same categories from the conversation. Foyer is not designed to solicit diagnosis, insurance, medical-record, or payment-card details.

2. Why we process it

• To transcribe, summarize, route, or take a message for the call.
• To notify the Foyer member and obtain a live instruction when that feature is enabled.
• While Call learning is enabled (the default where available), to apply best-effort automated redaction and use an AI processing service to extract useful provider relationships from eligible connected-call transcripts and automatically refresh a bounded screening summary. Safe eligible details can influence screening automatically; ambiguous, conflicting, or sensitive details may wait for review. The filters are designed to remove diagnoses and other health details but can miss them, in which case that transcript text may be processed by the AI service. The member may turn learning off at any time; this stops future extraction and removes automatically managed learned details from active screening while retaining their private history. Owner-authored profile details remain active. Call learning does not itself enable recording or transcription.
• To secure, troubleshoot, and support the service without placing the call content into analytics.
• To comply with law and valid legal process.

3. Sources and disclosures

The information comes from the caller, the Foyer member, caller-ID and carrier data, and information produced while operating the service, such as a transcript, summary, or routing outcome.

The categories disclosed are limited to the health-related call content and associated identifiers needed to deliver the requested service. They may be processed by telephony, speech, AI, hosting, database, notification, email, and private-storage providers described on our service provider categories page. The Foyer member receives the resulting call record and notifications. We do not disclose consumer health data to unaffiliated third parties for their own purposes, have no affiliates with whom we share it, and do not sell it or share it for cross-context behavioral advertising.

4. Your choices and rights

Subject to identity verification and applicable law, a Foyer member or caller may ask us to confirm whether we collect, share, or sell consumer health data about them; access or correct that data; receive a list of disclosures and available contact information for recipients; withdraw consent from future collection or disclosure; or delete the data. We do not require a caller to create a Foyer account to make a request.

Email [email protected] from the member account email or include the number used for the call so we can locate the record without collecting unnecessary information. We respond within 45 days, subject to one 45-day extension where the law permits, and provide up to two requests per year free of charge. If we deny a request, you may appeal by replying with “health data appeal” in the subject line; we will respond to the appeal within 45 days and, if it is denied, explain how to contact the Washington Attorney General or other appropriate regulator.

5. Retention and security

Health-related details follow the retention periods in our Privacy Policy. In the current limited rollout, connected-call audio retained for enabled transcription has no automatic expiration date. An archived Call-learning item remains in the encrypted private ledger with source history; turning learning off likewise retains private history but removes automatically managed learned details from active screening, while owner-authored profile details remain active. Rejecting or deleting an item erases the readable learned value, although limited content-free decision and evidence metadata may remain so the service can honor that choice. Members and callers may request deletion of a health-related record earlier. We notify applicable processors and other recipients of a verified deletion request. Deletion from archived or backup systems may be delayed until those systems are restored, but will be completed no later than six months after the request is authenticated. Data is encrypted in transit, account data is isolated at the database level, and stored audio is private and accessed through short-lived signed links.

6. Location and geofencing

Foyer does not collect precise location for health-related purposes and does not use geofences around health-care facilities to identify or track consumers, collect consumer health data, or send health-related notifications or advertising.

7. Professional and HIPAA use

Foyer is not offered as a HIPAA-compliant service by default. A HIPAA covered entity or business associate must not use Foyer to create, receive, maintain, or transmit protected health information unless Engineering Pixels LLC has signed a written agreement that expressly permits that use.

8. Contact

Questions or requests: [email protected]. Engineering Pixels LLC, Massachusetts, USA.