The short, honest versions, written to be read, with the effective dates that matter.
What we collect. Account details you give us (name, work email, practice info), product usage (features used, device and log data), and billing details processed by our payment partner. Patient data your practice stores in Linden belongs to your practice. We process it only on your instructions, under the BAA below.
What we never do. We don't sell personal data. We don't use your patients' health information to train models, target ads, or build profiles. We don't show your clients other businesses. There is no marketplace.
Your rights. Access, correct, export or delete your data at any time by emailing privacy@lindenhq.com, and we will action it. Self-serve export and deletion from Settings → Compliance is coming soon; today those requests are handled by us rather than by a button. CCPA and state-law requests are honored regardless of where you live.
Retention. Practice data is kept while your subscription is active, exportable for 90 days after cancellation, then permanently deleted, with a final notice 7 days before deletion.
Facebook and Instagram messages. We are building a social inbox so a practice can answer Messenger and Instagram enquiries from people who have not booked yet. It is not switched on. Connecting a Facebook Page requires Meta's review of our app, that review is not complete, and no practice can connect one today.
Meta signs no Business Associate Agreement, so if and when this channel opens it is for enquiries only and never for care. A conversation about a specific person's treatment does not belong on it - and, more to the point, cannot structurally be put on it. That is not a promise in a policy; it is three controls a test enforces on every build, which fails if any of them is removed:
One. The list of channels our clinical conversation store accepts cannot include Messenger or Instagram. Adding them would be a one-line change that makes the feature “just work” by putting a non-BAA vendor's message stream into the store that holds patient data, so the check reads the database constraint itself. Two. No table holding social messages carries a patient or client identifier, or any reference into clinical data. The column is absent rather than unused, because an unused column is what makes the wrong feature cheap to build later. Three. No source file may mention both the social message store and clinical data in code that runs - which is what makes the query that would join the two impossible to write, and is also why no message text can be copied from a DM into a patient's record.
By design, the moment a conversation needs identity or care, staff move it to an authenticated Linden surface, and that move is a one-way door: the secure conversation records only that a handoff happened and an opaque reference to it, never the words that were exchanged. That handoff is designed and gated but not yet built, like the rest of the channel.
Analytics on this website. This marketing site uses PostHog to understand how visitors use it. On your first visit it stores a randomly generated identifier - in a cookie on this domain and in your browser's local storage - that lasts up to a year, and it records the pages you open, the elements you click and a replay of your session on this site. If your browser sends a Do Not Track signal we do not start any of it. Clearing or blocking cookies for this domain clears the identifier.
This analytics does not run where your patients are. It is loaded on this marketing website only. The Linden product itself - the practice app, the patient app and our admin console - ships no analytics SDK and no session recording at all, precisely because session replay records the contents of a screen and those screens hold patient data. Nothing a patient enters in Linden is captured by anything described in this paragraph.
Text messages (SMS). Linden OS sends appointment reminders, booking and reschedule confirmations, and front-desk replies by SMS on behalf of the practice you booked with, to patients who opted in. Message frequency varies with your appointments. Standard message and data rates may apply. Reply STOP to any message to opt out, or HELP for help.
Your mobile information will not be sold or shared with third parties for promotional or marketing purposes. All the categories above exclude text-messaging originator opt-in data and consent; this information will not be shared with any third parties. We will not share your opt-in to an SMS campaign with any third party for purposes unrelated to providing you with the services of that campaign. We may share your personal data, including your SMS opt-in or consent status, with third parties that help us provide our messaging services — including but not limited to platform providers, phone companies, and any other vendors who assist us in the delivery of text messages.
The deal. You pay a monthly subscription; we run the software, keep it available and support you. Plans are month-to-month. Cancel anytime from Settings with no fee, and access runs to the end of the period you've paid for.
Your responsibilities. Keep your account secure, use the platform lawfully, and make sure you have the right to store the client data you upload. Clinical judgment stays with your licensed providers. Linden (including Lin and AI charting) is an administrative tool, not a medical device.
Payments. Card processing is provided with our payment partner; processing fees are shown at checkout and never marked up. Failed subscription charges retry twice before staff access pauses. Patient data is never held hostage over billing.
If we part ways. Your data is yours: full export in open formats (CSV, PDF) before and up to 90 days after your plan ends. We can terminate for abuse, fraud or non-payment, with notice except where the abuse is severe.
Found a vulnerability? security@lindenhq.com. We run a coordinated disclosure program and respond within 24 hours.
Not yet available - in preparation. Counsel's BAA template is not final, so Linden cannot offer or countersign a BAA with any practice today, and no practice has one. The agreement surface is already built and shipped: Settings → Compliance shows the pending status now, and the day the template is finalized it becomes the document you review, accept and keep a countersigned copy of there. Until then, treat the section below as a description of the agreement we intend to offer, not one you have.
What it covers. We act as your business associate: PHI is used only to provide the service, disclosed only as the agreement allows, safeguarded per the Security Rule, and breach-notified within the statutory windows (we commit to 72 hours, faster than required).
AI and PHI. Lin answers web chat and SMS - there is no voice channel today. Public web chat keeps no transcript on our servers at all: what we retain is the business outcome of a turn, never the words. Lin runs on a HIPAA-eligible cloud service under our own agreement with that provider, configured so the provider retains nothing, and none of your data trains shared models. Lin is granted per practice and can be switched off for a practice at any time. The AI scribe is not built yet; when it ships it will run under these same rules.
Subprocessors. We use subprocessors for hosting, telephony, payments and email. The current list is available on request from privacy@lindenhq.com. A published list at a permanent URL, with 30-day advance notice of changes, ships with the BAA above - we are not promising a page that does not exist yet.