This Privacy Policy describes how Aequitas, a subdivision of TRIJ Ventures, Inc. d/b/a Kronos Health (“Aequitas,” “we,” “us”), collects, uses, and protects information in connection with the Aequitas legal and medical reporting platform (the “Service”). Because the Service is used to process protected health information (PHI) on behalf of covered entities and their business associates, our handling of PHI is also governed by the applicable Business Associate Agreement (BAA), which controls in the event of any conflict with this policy.
1. Information we process
We process the following categories of information:
- Account information — names, work email addresses, and role for users we provision (physicians, firm and carrier staff).
- Case content — uploaded records, exam transcripts, and report drafts, which may contain PHI relating to injured workers.
- Audit and usage data — logs of access, edits, permission grants, and signatures used to maintain the audit trail and secure the Service.
2. How we use information
We use information to provide and secure the Service, including to:
- OCR records, generate report drafts, and produce exports at the direction of authorized users.
- Enforce per-case access permissions and maintain the append-only audit trail.
- Diagnose issues, prevent abuse, and meet legal and contractual obligations.
We do not sell personal information or PHI, and we do not use PHI for advertising.
3. How we protect information
We implement administrative, technical, and physical safeguards designed to protect information, including encryption of PHI in transit and at rest, least-privilege access controls, per-case permissioning, and append-only audit logging. No method of transmission or storage is perfectly secure, but we work to align our controls with applicable obligations.
4. Sharing
We share information only as needed to operate the Service — for example, with infrastructure and AI subprocessors operating under appropriate agreements — or as required by law. PHI is shared with counsel and other parties only as directed through the Service’s per-case permission controls.
5. Retention
We retain case content and account information for as long as needed to provide the Service or as directed by the applicable covered entity, and as required by law and the BAA. Audit records are retained for the life of the account to preserve defensibility, and may be retained longer than case content.
Retention ends when a practice closes its account and its data is destroyed, as described in Section 6. Your organization is responsible for its own records-retention obligations — where those require you to keep an IME beyond the life of your Aequitas account, export it before closing.
6. Exporting your data, closing your account, and destruction
Export. A practice administrator can request a complete export of the practice's data at any time, from Admin › Account. The export is a single archive containing the examinee and claim details, the case files as they were uploaded, the finalized report PDFs, the report text, intake and examination records, and the practice's audit trail. It is prepared in the background and made available through a time-limited download link (currently 72 hours), after which a new export can be requested. Each export and each download is recorded in the audit trail.
Closure. A practice administrator can close the account from Admin › Account. Closing cancels the subscription and begins a 30-day grace period. During the grace period the account becomes read-only: users can still sign in to view the practice's cases and to request and download an export, but cannot create or change anything. Closure can be reversed during the grace period by contacting us.
Destruction. After the grace period ends, the practice's data is permanently destroyed — stored case files, reports, examinee and account records, and the practice's audit records. Destruction is irreversible and cannot be undone once carried out; we retain only a record that the destruction occurred. Export anything you need to keep before the grace period ends.
7. Your rights
Rights regarding PHI are generally exercised through the relevant covered entity. For other personal information, you may contact us to request access or correction, subject to applicable law. Practice administrators can obtain a copy of the practice's data at any time using the export described in Section 6.
8. Contact
Questions about this policy can be directed to aequitas@kronosgroup.health.