Privacy Policy

Quadline Systems, LLC ("Quadline Systems," "we," "us," or "our") respects your privacy and is committed to safeguarding personal data and practice information. This Privacy Policy applies to our website (quadlinesystems.com), marketing communications, software applications, and practice growth services (collectively, the "Services").

When healthcare practices deploy Quadline Systems to manage patient intake, scheduling, SMS reminders, and recall automation, the handling of Protected Health Information (PHI) is governed by our Business Associate Agreement (BAA) executed with each Covered Entity pursuant to HIPAA (45 CFR Parts 160 and 164). This Privacy Policy covers website visitors and general user interaction, while supplementing our formal BAA governance.

We collect information across three primary channels:

• Information You Provide Directly: Name, professional title, practice or organization name, work email address, phone number, billing details, specialty area, and any inquiries submitted through contact forms or demonstration requests.
• Automated Usage Data: IP address, browser type, device operating system, referring URL, timestamped interaction events, and site navigation metrics captured through essential server logs and privacy-first analytics.
• Practice Operational Data & PHI (Under BAA): When a practice integrates Quadline Systems, we process appointment schedule slots, patient contact identifiers, intake responses, and message status logs solely to perform requested services under the direction of the practice.

We process collected data exclusively for explicit operational purposes:

• To deliver, configure, and maintain the Practice Revenue Operating System.
• To authenticate authorized practice personnel and secure account access.
• To send administrative updates, security alerts, and system notices regarding your deployment.
• To verify carrier-compliant A2P 10DLC SMS registration and deliver transactional appointment pings.
• To fulfill legal, regulatory, and audit obligations under HIPAA and state laws.

Where applicable data protection frameworks apply (including state privacy acts and GDPR), we rely on the following legal grounds:

• Contractual Performance: Providing services requested under your practice subscription agreement and BAA.
• Legitimate Business Interests: Securing infrastructure, preventing fraud, and optimizing system uptime.
• Consent: Where explicit opt-in consent is captured for communications or digital intake.
• Legal Obligation: Maintaining audit records as mandated by healthcare regulations and carrier standards.

Quadline Systems does NOT sell, rent, or trade personal information or practice data to third parties. We disclose data only in the following limited circumstances:

• Form Submission Service Providers: Service providers process website contact and demo form submissions on our behalf solely to deliver those submissions to Quadline Systems. These providers act under our instructions, are bound by confidentiality and security obligations, and do not sell, share, or use submission data for their own purposes.
• HIPAA Business Associates & Subprocessors: Certified cloud infrastructure, encrypted data centers, and telecommunications gateways that execute formal Business Associate Subcontractor Agreements (BAAs) and adhere to strict confidentiality terms.
• Legal & Regulatory Compliance: When required by Subpoena, court order, or official law enforcement inquiry to protect the rights, property, or safety of Quadline Systems, our practices, or the public.
• Corporate Transactions: In the event of a merger, acquisition, or asset reorganization, customer data remains subject to pre-existing BAA protections and privacy commitments.

Quadline Systems operates as a Business Associate for covered healthcare practices. Prior to processing any Protected Health Information (PHI), Quadline Systems executes a standard or custom Business Associate Agreement (BAA) with the practice.

Under our BAA, Quadline Systems maintains administrative, physical, and technical safeguards in compliance with the HIPAA Security Rule (45 CFR Part 164, Subpart C) and HIPAA Privacy Rule (45 CFR Part 164, Subpart E). Practice data is processed only as permitted under the BAA and relevant state healthcare regulations.

We retain personal data and practice records for as long as necessary to fulfill the purposes outlined in this policy or required by contractual agreement. Upon contract termination or written request from a practice, Protected Health Information is returned or securely destroyed in accordance with BAA terms and NIST SP 800-88 sanitization standards.

Quadline Systems maintains multi-layered security controls to safeguard data integrity:

• Encryption Standards: AES-256 encryption for data at rest and TLS 1.3 encryption for data in transit.
• Access Governance: Role-based access control (RBAC), multi-factor authentication (MFA), and least-privilege administrative access.
• Monitoring & Audit Logs: Continuous infrastructure monitoring, immutable audit logging, and automated threat detection.

Depending on your jurisdiction and state residency (including California CCPA/CPRA rights), you have the right to request access to, correction of, or deletion of your personal information. You may also opt out of promotional communications at any time.

To exercise these rights or submit a privacy inquiry, contact our Data Protection team at privacy@quadlinesystems.com.

Our Services are business-to-business tools intended for healthcare practice operators and personnel. We do not knowingly collect personal data directly from children under 16 through our public website. Pediatric patient data processed on behalf of covered practices is governed strictly by the practice BAA and HIPAA rules.

We may update this Privacy Policy periodically to reflect changes in legal requirements, carrier regulations, or service enhancements. Material changes will be posted on this page with an updated effective date.

If you have questions regarding this Privacy Policy, our HIPAA compliance posture, or data protection practices, please reach out to: