Blythe, Inc. (“Blythe,” “we,” “us,” or “our”) provides a reputation and review-management platform for independent healthcare practices. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to getblythe.com, app.getblythe.com, and any related Blythe-operated surfaces (collectively, the “Service”).
Blythe is designed to be HIPAA-aware. When a healthcare practice (a “Practice”) uses the Service to handle Protected Health Information (“PHI”) on behalf of its patients, Blythe acts as a Business Associate under a separate Business Associate Agreement (“BAA”). The terms of that BAA control the handling of PHI and supersede anything in this policy that conflicts with it.
When a Practice signs up for the Service or invites team members, we collect contact details (name, work email, role), authentication identifiers from our identity provider (Clerk), payment details handled by our payment processor (Stripe — we do not store full card numbers), and information needed to connect third-party integrations (e.g., Google Business Profile OAuth tokens, which are stored encrypted in Google Secret Manager rather than in our database).
When a Practice uses the Service to send review requests, we process limited patient contact information the Practice provides — typically a first name, a phone number or email address, an appointment timestamp, and the visit type or provider. Where this information constitutes PHI, it is encrypted at the application layer using Google Cloud KMS before it is stored, and access is logged in an audit trail. Blythe does not collect medical-record content, diagnoses, or treatment notes from Practices through the Service.
The Service ingests publicly posted reviews from third-party platforms (Google, Yelp, Facebook, Healthgrades, Vitals, and similar) and the responses Practices publish to those platforms. This content is already public; we associate it with the relevant Practice account so it can be replied to and reported on.
Like most web applications, the Service automatically collects technical information when you visit or use it: IP address, browser type and version, device and OS information, the pages you view, the actions you take, and timestamps. We use this information for security, debugging, and to understand how the Service is being used.
We use first-party cookies and similar technologies for authenticated sessions (via Clerk), security (CSRF protection), and limited product analytics. We do not use cookies for cross-site advertising, and we do not sell information to ad networks. You can disable cookies in your browser; some parts of the Service will not function without them.
We use the information we collect to:
Blythe does not use PHI for advertising, marketing to third parties, or training general-purpose AI models. We do not sell personal information.
Some plans include SMS-based review requests sent on a Practice’s behalf. The Practice is responsible for obtaining each patient’s prior express written consent to receive these messages, and for honoring opt-outs. When SMS is enabled:
We share information only in these circumstances:
Information you submit to the Service is visible to other authorized users of the same Practice account. The Practice administrator controls who has access.
We use a small number of vendors to operate the Service. Each is contractually required to protect information consistent with this policy and, where applicable, with our BAA. Current subprocessors include:
A current subprocessor list is available on request at hello@getblythe.com; we will provide reasonable notice of material changes.
We may disclose information if we believe in good faith that it is required to comply with a valid legal process (subpoena, court order, regulatory request) or necessary to protect the rights, safety, or property of Blythe, our customers, or the public. Where the law allows, we will notify the affected Practice before disclosure.
If Blythe is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction. We will notify Practices in advance and the receiving party will be bound by this policy or a successor that is materially as protective.
No system is perfect. If we discover a breach affecting your information, we will notify the Practice administrator without undue delay and, where required by law, the relevant regulators. Practice users are responsible for keeping their account credentials confidential.
We retain information for as long as needed to provide the Service and meet our legal obligations. Specifically:
Practices control most of the information in their account through the Settings area of the Service. You can also exercise the following rights, subject to verification of identity:
To exercise any of these rights, email privacy@getblythe.com. For California residents, please see the “California privacy rights” section below. Patients should contact the Practice that holds their information directly; Practices are the data controllers for their patient records.
California residents have the right to know what personal information we collect and how we use it (described above), to request deletion or correction, to opt out of any sale or sharing of personal information (we do not sell or share for cross-context behavioral advertising), and to be free from discrimination for exercising these rights. To submit a request, email privacy@getblythe.com. We will respond within the time required by law.
The Service is intended for use by adult representatives of healthcare Practices and their adult patients. We do not knowingly collect personal information directly from children under 13. If you believe a child under 13 has provided us with personal information, contact privacy@getblythe.com and we will delete it.
The Service is operated from the United States and is intended for U.S. healthcare practices. If you access the Service from outside the U.S., your information will be transferred to and processed in the United States. We do not currently market the Service to residents of the European Economic Area, the United Kingdom, or Switzerland; if that changes, this policy will be updated to address those frameworks.
We may update this Privacy Policy from time to time. When we do, we will revise the “last updated” date at the top and, for material changes, notify Practice administrators by email. Continued use of the Service after a change means you accept the updated policy.
Questions about this policy or our privacy practices? Email privacy@getblythe.com or write to:
Blythe, Inc.
Attn: Privacy
[Mailing address — to be added]