Privacy Policy
Last updated: November 2026
Overview
This policy explains what the haau3 platform, operated by Brian K. Fung Media LLC, doing business as haau3, collects and how we use it. The platform is designed to handle public and synthetic healthcare data. The Services designated to receive protected health information, listed at docs.haau3.com/patient-data, receive it only under a business associate agreement (BAA) with haau3 in force, on the Team or Scale plan, and store nothing they are sent.
Information we collect
We collect account information you provide (such as name, email, and organization), authentication data managed by our identity provider, operational data such as API usage and logs needed to run and secure the Services, and page-view analytics for this website, which use no cookies and identify a visit by a hash that is discarded within 24 hours. Our documentation site, docs.haau3.com, is hosted by Mintlify, which keeps visitor analytics of its own; Mintlify’s privacy notice covers what it collects there.
No PHI by default
The platform does not require or expect protected health information. Do not send PHI except through the Services designated to receive it, listed at docs.haau3.com/patient-data, and only once your organization is on the Team or Scale plan and has a BAA with haau3 in force. A designated Service stores nothing it is sent and logs no request body. The other APIs serve public data (provider availability, the provider directory, terminology, questionnaires, and health plan benefits), the Structured Sig API takes a prescription’s directions and a medication’s codes, never a patient, and the dashboard is not for PHI: its MedList playground sends synthetic example records only, its Pharmacy Benefits playground sends synthetic test members to the Sandbox only, and its Structured Sig playground takes directions only, never a patient’s name or details.
How we use information
We use information to provide and improve the Services, authenticate users, enforce usage limits, communicate with you, and maintain security. We do not sell your personal information.
Who processes data for us
The companies that handle data for us, and the public sources some requests are answered by, are listed on our Security page. Google, under its business associate agreement with haau3, is the only company that processes protected health information for haau3. When a Service sends a request to another party for you, such as a member’s request to the member’s own health plan, that party receives only what the request needs, as docs.haau3.com/patient-data describes.
Data retention
We retain account and operational data for as long as your organization uses the Services and as needed for legitimate business and legal purposes. The API’s access log, which records each request with your organization and key, is kept for at least a year, and usage records are kept as billing records.
Your choices
You can access and update your account information, and request deletion of your organization’s data, subject to legal and operational constraints.
Changes
We may update this policy from time to time and will communicate material changes through the platform or by email.
Contact
Questions about this policy can be directed to hello@haau3.com.