Privacy Policy

Effective October 6, 2026

1. Who we are

Steadfill ("Steadfill", "we", "us") sends appointment reminders, rescheduling, waitlist offers and follow-up messages by text for healthcare practices. This policy explains what information we collect, how we use it, who we share it with and the choices you have. If you have a question, email hello@steadfill.com.

2. Information we collect

From practices and website visitors

• Pilot requests. When you fill in our pilot form, we collect your practice name, practice type, your name and role, work email, phone number, number of clinicians and anything you write in the optional note. The form is delivered to our inbox by Formspree, a form service.
• Emails. If you email us, we keep your message and your contact details so we can reply.
• Practice accounts. When a practice uses Steadfill, we collect staff names, work emails, roles, login and security details, and billing details. Card payments are handled by our payment provider. We do not store full card numbers.
• Basic technical information. Our website host may record standard technical details such as IP address, browser type and the pages requested, to keep the site secure and working. We do not use advertising or tracking cookies.

Patient information, on behalf of practices

When a practice uses Steadfill, it shares a small amount of patient information so we can send messages for the practice:

• first name and mobile phone number
• clinician name, appointment date and time, and appointment status
• text-message consent and opt-out status
• times a patient says work for them, for waitlist offers
• the messages sent and received

We do not collect diagnoses, clinical notes or insurance ID numbers.

This information is protected health information under HIPAA. The practice is the "covered entity" and Steadfill is its "business associate". We use and share patient information only as HIPAA and our Business Associate Agreement with the practice allow. If anything in this policy conflicts with a BAA, the BAA controls.

3. How we use information

• To answer pilot requests and questions, set up and support practice accounts, and bill for the service.
• To send a practice's appointment messages: reminders, confirmations, rescheduling, waitlist offers and follow-ups after missed visits.
• To sort patient replies. We use an AI service, under a BAA, to tell whether a reply is a confirmation, a cancellation, a request to reschedule or something that needs a person. Steadfill's AI never gives clinical advice, and it never books or cancels on its own.
• To send messages that need a person to the practice's staff.
• For safety. If a message suggests a crisis, Steadfill sends an immediate reply with 988 and 911 information and alerts the practice's staff.
• To prepare reports for the practice, such as the monthly report of recovered visits.
• To keep the service secure, prevent misuse and meet our legal obligations.

Patient information is not used to train AI models, and it is never used for marketing.

4. Text messages

• Practices collect each patient's consent to receive text messages before Steadfill sends any.
• How often we text depends on your appointments, usually a few messages for each visit. Message and data rates may apply.
• Reply STOP at any time to stop all texts, and START to sign up again. Reply HELP for help, or contact your practice.
• No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging opt-in data and consent are never shared with any third party, other than the providers that deliver the messages for us.

5. How we share information

We do not sell or rent personal information. We share it only:

• With service providers that help us run Steadfill, such as hosting and database, text-message delivery, AI reply sorting, email, form handling and payments. Every provider that handles patient information signs a BAA with us.
• With the practice the information belongs to.
• When the law requires it, or when needed to protect someone's safety.
• If Steadfill is merged or sold. Any new owner must keep the same protections, including our BAA obligations.

6. How we protect information

Information is encrypted in transit and at rest. Staff logins are role-based and use two-factor authentication, access is limited to people who need it, and every staff action is logged with who did it. No system is perfectly secure, but if a breach affects patient information, we will notify the affected practices as HIPAA and our BAAs require.

7. How long we keep information

• Pilot requests and emails: as long as we need them to respond and to keep reasonable business records.
• Patient information: only while the practice uses Steadfill. When a practice cancels, we delete its patient information within 30 days, unless the law requires us to keep it longer. We will send the practice a copy first if it asks.

8. Your choices and rights

• Patients: your practice controls your records. To see, correct or get a copy of your information, contact your practice, and we will help them respond. You can stop texts at any time by replying STOP.
• Practices and website visitors: email hello@steadfill.com to see, correct or delete your information. Depending on where you live, you may have other privacy rights, and we will honor them.

9. Children

Our website is not meant for children under 13, and we do not knowingly collect their information through it.

10. Changes to this policy

If we change this policy, we will post the new version here and update the date at the top. For important changes, we will also email the practices that use Steadfill.

11. Contact us

Questions or requests: hello@steadfill.com