Privacy policy

Information we handle for a facility

When you call, chat, text or email a treatment center and Fenna answers, everything you say belongs to that center. We are what the law calls a business associate. We hold that information for them, under a signed business associate agreement and qualified service organization agreement, and we use it only to run the service for them.

This policy does not govern that information. That agreement does, along with the facility’s own notice of privacy practices. We do not sell it. We do not use it to train models. We do not use it for our own purposes.

If you want to see what a facility holds about you, correct it, or complain, ask the facility. They are the ones who can answer, and the law puts the decision with them, not with us. If you are not sure who to contact, write to us at privacy@fennahealth.com and we will point you to the right place.

Texas residents: the information Fenna handles for a facility is stored and sent electronically, and it may be disclosed electronically for the purposes the facility’s own notice of privacy practices describes. That notice governs it.

Information that is ours

Everything else in this policy is about information we collect for ourselves: people who visit fennahealth.com, people who book a demo, staff at our customers who sign in to the product, billing contacts, referral partners, and people who write to support. We decide what happens to that information, so the rest of this page is about it.

Two more things are ours: the demo chat on our home page and the demo line, (602) 536-0897. Fenna answers both for Aurora House, a sample facility we run, so what you write or say there comes to us and to no treatment center, and this policy covers it. A call to the demo line is recorded, as she says when she picks up.

We do not buy lists. We do not collect information from children, and our product is not for anyone under eighteen.

We do not sell personal information. We do not share it for cross-context behavioral advertising. We have not done either in the last twelve months, and we do not plan to. Because of that there is no “Do Not Sell or Share My Personal Information” link on this site, and there is nothing to opt out of.

We still honor an opt-out preference signal such as Global Privacy Control across this site, so if your browser sends one, we treat it as a valid instruction.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the categories above exclude text messaging originator opt-in data and consent, and that information will not be shared with any third parties.

We use other companies to run Fenna. Our servers and the data we store, call recordings included, are with Amazon Web Services in the United States. We hold written agreements with the companies that store, carry and transcribe patient information, and we are working through the same agreements with the rest. Ask us at privacy@fennahealth.com which companies are covered today and we will tell you plainly.

• Amazon Web Services hosts the service and stores the data, call recordings included. Until early November 2026, Microsoft Azure also holds the copies made before we moved; we delete them then.
• OpenAI gives Fenna her voice, answers the phone, writes what she says on chat, text and email, and reads an insurance card when a facility’s team adds a photo of one.
• Telnyx carries the phone calls and the text messages, and records each call. It holds a recording only until we move it to our own storage, normally within minutes of the call ending.
• Stedi asks insurers about eligibility.
• RustyRAG searches a facility’s own documents so Fenna can answer a question from them. The question goes with the search.
• Google Workspace carries our email, including the alerts that tell a facility’s team about a caller, under Google’s business associate terms.
• Stripe takes payment. We never see your card number, and nothing about a caller reaches it.
• Apple distributes our iPhone app and delivers its alerts. An alert says only that something is waiting for the team. It never names a caller, gives a number or says why anyone called.
• Google Analytics counts visits to our public pages. It never sees a caller, a patient or anything behind a sign-in.
• Cloudflare runs the check that keeps bots off our sign-up and password reset pages. On those two pages it receives your network address and browser details for that check, and nothing you type. It is never on a facility's website or in the chat window.

We will tell customers before we add a company that handles patient information. We also hand over information when the law makes us, and we will tell the facility first unless we are forbidden from doing so.

A facility can connect its admissions mailbox so Fenna can read and answer email, and its calendar so she can book assessments. That connection is made by an administrator, it is limited to the one mailbox and the one calendar you choose, and you can disconnect it at any time from Settings in the app. We support Microsoft 365, through Microsoft Outlook and Microsoft Calendar, and Google Workspace, through Gmail and Google Calendar.

From Gmail and Microsoft Outlook we read the messages in the mailbox you connect: the sender, the subject, the body and the attachments. We read them so Fenna can write a reply, so your team can see the thread in the product, and so a callback can be opened when someone asks for a call. We send a reply from that same mailbox. We do not read any other mailbox in your organization.

From Google Calendar and Microsoft Calendar we read the free and busy times on the calendar you connect, and the events Fenna created. We read them so she can offer a time that is actually free, and we write an event when someone books an assessment. We do not read the contents of events we did not create.

We keep that content for as long as the facility uses Fenna, because it is their record of the conversation, and we delete or return it when they leave, as the business associate agreement requires. We share it only with the companies listed above, which host and run the service. We do not use it to train models. We do not use it for advertising. We do not sell it. No human at Fenna Health reads it except to support your team when you ask, to keep the service secure, or where the law requires it.

Fenna’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Calls to a facility that Fenna answers are recorded and written down as they happen, so the facility has a record of what was said and can pick the conversation up where it stopped. The recording and the transcript belong to that facility.

We keep a recording for ninety days and then delete it. Anyone on the facility’s team who can open the call can play it, and each time someone does, we note who it was and when.

Some states require everyone on a call to agree before it is recorded. The facility is responsible for getting that agreement, and our agreement with them says so. If you would rather not be recorded, say so on the call. Fenna puts you through to someone on the team, or passes your name and number on when nobody can take the call, and we keep no recording and no transcript of that call, only the details she took down.

When someone on a facility’s team calls you back through Fenna, you hear “This call is recorded.” before anything is recorded. That recording is kept, played and deleted the same way. Telnyx listens to the first seconds of the answer to tell a person from a voicemail, and we keep only which one it was, so the team knows whether they reached you.

We do not use recordings or transcripts to train voice or language models, and neither does OpenAI.

If you text a facility’s number, Fenna replies once and then a person takes over. If you leave a number for a callback, the facility may text you about it. Facility staff get texts telling them a caller is waiting.

Message frequency varies. Message and data rates may apply. Reply HELP for help or STOP to stop at any time, and STOP stops it for good on that number. We also honor quit, cancel, end and unsubscribe.

We do not send marketing texts, and we do not text people who have not contacted a facility first.

Our public pages, fennahealth.com and the legal pages you are reading, use Google Analytics to count visits: which pages are opened, from what kind of device and browser, and roughly where from. Google sets its own cookies for that, beginning _ga, and receives your network address to work out your region; Google says it does not store the address. We use it only to see how the website is used, never for advertising, and we do not join it to who you are. Nothing else on our pages comes from another company’s servers: no advertising pixels, no fonts, no images.

Behind a sign-in there are no analytics at all, and none on the chat window a facility puts on its site. The demo chat on our home page carries none either: what you write in it goes to our own servers and the companies named above, and Google Analytics sees nothing of it.

Since October 29, 2026 a facility can also put our call-tracking script, fenna-track.js, on its own website, so each visitor sees one of the facility’s phone numbers and a call to it is matched to the visit. That script is ours and talks only to our servers: it sets no cookie, keeps one random visit id in your browser’s local storage for 30 days, reads nothing you type and nothing from the chat window, and sends us the page’s path, the website that linked to it, any utm_ values and any advertising click id in the address, which we seal on arrival and never pass on. We keep no network address with a visit. If you then call, text or chat with the facility, that visit becomes part of your record with it and is handled as health information from then on; it is never sent to an advertising platform. A visit that led to no call, text or chat is deleted 90 days after the last page it reported.

The product uses a few cookies of its own. One keeps you signed in, one tells our home page you are signed in so it can show a link to the dashboard, and others remember how many rows fit on your screen. None of them is used to track you.

If you follow a partner’s link to our website, we set one cookie, fenna_ref, that holds that partner’s code for 90 days so we can credit them if your facility signs up. It holds nothing about you, and we only count how many times each link is followed.

We do not track you across other websites, and nothing on our pages is there to let an advertiser follow you. Google Analytics stays off for a browser that sends a Global Privacy Control or a Do Not Track signal, and Google’s own opt-out add-on, or blocking its script, keeps it off everywhere.

Wherever you live in the United States, you can ask us to do all of these, free, and we will answer within forty-five days. If we need longer we will tell you why, and we will not treat you worse for asking.

• Tell you what we hold about you, where we got it, why we have it and who we gave it to
• Give you a copy
• Correct anything that is wrong
• Delete it
• Stop using sensitive information for anything beyond running the service
• Stop making decisions about you by automated means, and explain any we have made

Write to privacy@fennahealth.com or use the form on our site. We may need to check who you are before we answer, which usually means replying from the address we already hold. Someone can act for you if they show us they are allowed to.

If you are unhappy with our answer you can appeal by writing to the same address with the word appeal in the subject. We will answer an appeal within forty-five days and tell you how to contact your state attorney general if you are still unhappy.

California residents: we have set out above the categories we collect, where they come from, why we have them, who we give them to and how long we keep them. We do not sell or share personal information, and we do not use sensitive personal information for anything beyond providing the service you asked for. The information Fenna handles for a treatment facility is protected health information and is outside these rights, because the business associate agreement and federal health privacy law govern it instead.

Washington residents: your consumer health data has its own policy. Read the consumer health data privacy policy.

A facility’s team can use Fenna on an iPhone. The app shows the same conversations as the web app and keeps them in the phone’s memory only while it is open. Nothing about a caller is saved to the phone, backed up to iCloud or shown on the lock screen. The app opens with Face ID or the phone’s passcode, covers itself when it leaves the screen, and keeps the sign-in in the phone’s keychain.

It uses the microphone only for calls a person places from a conversation. It sends no analytics and no crash reports of its own, and it holds no advertising or tracking code. Accounts are made by a facility’s admin, never in the app, and an admin who removes you from the team signs you out everywhere. To have your account deleted, write to privacy@fennahealth.com.

Everything is encrypted in transit and where it is stored. Access is limited to the people who need it, and we keep the servers patched. When someone opens a facility’s conversation or its Conversations list, plays a recording or connects a mailbox or calendar, we keep a record of who it was, when and from where, and nobody can change or delete that record from the product.

The table above says how long we keep each thing. When a facility stops using Fenna, they have thirty days to export their data, and after that we delete or return patient information as the business associate agreement requires and delete the rest on the schedule above. Backups age out on their own cycle within ninety days.

No system is perfectly safe, and we will not pretend otherwise. If something goes wrong with information we hold for a facility, we tell that facility within twenty-four hours of finding out. The facility then tells the people affected, as federal law asks of it. If something goes wrong with information that is ours, we tell you directly and tell whoever else the law says we must.

We will update this policy when what we do changes. The date at the top says when this version took effect. If a change matters, we will email account holders before it lands.

Fenna LLC. Our postal address is 30 N Gould St Ste N, Sheridan, WY 82801. Write to privacy@fennahealth.com about anything on this page, and to legal@fennahealth.com about the terms of service. We answer every message.