hireJudi logo

Privacy Policy

Effective date: August 10, 2026

hireJudi is a product of Vector Digital Solutions LLC, a Nevada limited liability company, located at 732 S 6th St STE N, Las Vegas, NV 89101 (hereinafter "hireJudi," "we," "us," or "our"). This policy explains what information we collect, how we use it, and the choices you have.

We play two different roles, and your rights depend on which one applies to you:

  • If you visit our website or hold a hireJudi account (you own or work at a practice that uses hireJudi), we decide how your information is handled, and Section 1 applies to you.
  • If you are a client, patient, or caller of a practice that uses hireJudi (you called a number Judi answers, filled out an intake form, or booked an appointment), that practice controls your information and we process it on the practice's behalf. Section 2 applies to you, and your primary privacy relationship is with the practice, not with us.

By using our site, you agree to the collection and use of information as described herein. If you do not agree with this Policy, please do not use the Service.

Section 1 — Website visitors and hireJudi customers

What we collect

  • Account information: name, email address, business name, and login credentials when you create an account. Passwords are stored hashed; multi-factor authentication secrets are stored encrypted.
  • Billing information: processed by Stripe, our payment processor. We do not store full card numbers on our systems.
  • Communications: messages you send us (contact forms, support, waitlist signups).
  • Website analytics: we use a self-hosted, cookieless analytics tool (Umami). It does not use advertising cookies, does not build cross-site profiles, and no analytics data is shared with third-party ad platforms. Our marketing website does not run third-party advertising trackers.
  • Cookies: we use only cookies necessary for the product to function (such as keeping you signed in). See our Cookie Policy for the list.

How we use it

To provide and improve the service, process payments, respond to you, secure accounts, and send service communications. We send marketing email only where permitted and always with an unsubscribe link. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Your choices

You can access, correct, or delete your account information from your account settings or by contacting us. You can unsubscribe from marketing at any time. Deleting your organization deletes its data subject to the retention rules in Section 3.

Section 2 — Clients, patients, and callers of practices that use hireJudi

When a practice uses hireJudi to run its front office, we process information on that practice's behalf and under its instructions ("Service Data"). This can include:

  • call and web chat conversations with Judi, including recordings and transcripts (see "Call recording" below);
  • contact details you share to book an appointment;
  • intake forms, documents, and electronic signatures the practice asks you to complete;
  • appointment details, and invoices or payments the practice sends you.

The practice owns this information. We use it only to provide the service to the practice, never for advertising, and we do not sell it. Where the practice is a healthcare provider covered by HIPAA, we act as a Business Associate and process this information under a Business Associate Agreement with safeguards that include encryption in transit and at rest, role-based access, and audit logging. Where the practice is not itself covered by HIPAA, we process Service Data as the practice's service provider (or equivalent role) under applicable state data-protection and consumer-health-data laws, which may impose obligations on us and the practice in addition to this policy and are not satisfied by the Business Associate framework described above.

To exercise privacy rights over Service Data (access, correction, deletion), contact the practice you interacted with. We support practices in fulfilling these requests. If you contact us directly, we will route your request to the practice.

Call recording and AI disclosure

Calls answered by Judi may be recorded and transcribed to provide the service. By default, Judi's greeting discloses that the caller is speaking with an AI assistant and that the call may be recorded; practices can customize this greeting. Practices are responsible for configuring greetings and obtaining any consents required by the laws of the places they and their callers are located; under the practice's Terms of Service with us, configuring the service in violation of applicable law is a material breach.

Text messages

Judi may send you a text message when you ask for one, or accept Judi's offer of one, during a phone call, such as a booking confirmation or a link to an intake form. These are one-time messages tied to your request; hireJudi does not send marketing texts, and scheduled reminders are delivered by email. Message and data rates may apply.

Section 3 — Retention and deletion

  • Service Data is retained while the practice's account is active and per the practice's configured retention settings. Voice and chat recordings and transcripts are retained for a period the practice configures (default 60 days; range 1–730 days) and are deleted after that period.
  • When an organization is deleted, its data enters a thirty (30) day grace window (during which the deletion can be cancelled and data can be exported), after which it is permanently purged from active systems. Residual copies in routine encrypted backups age out on our standard rotation and are not restored except for disaster recovery or legal compliance.
  • We may retain limited records where required by law (for example, billing records for tax purposes).

Section 4 — Who we share information with (subprocessors)

We use a small set of service providers to run hireJudi, in these categories: cloud hosting, database, and storage; transactional email delivery; AI voice, chat, and inference processing; and payment processing (payment data only — patient information is kept out of payment descriptions). Where a provider may handle Service Data for HIPAA-covered practices, we have a Business Associate Agreement with them. The current list of our subprocessors, by name and function, is available to customers and prospective customers on request at hello@hirejudi.com. We update the list before adding or replacing a provider that handles Service Data, and practices with an executed BAA receive thirty (30) days' prior notice of changes.

Customer-Connected Services. A practice may connect a third-party account, application, platform, mailbox, calendar, payment account, communications provider, or other service that it independently selects and controls. To maintain the connection, we process provider and account identifiers and encrypted OAuth tokens, app-specific passwords, API keys, or similar authorization material. The provider is governed by the practice's agreement and is not a hireJudi subprocessor solely because the practice connects it. The practice is responsible for the permissions, contracts, BAAs, consents, or other terms required for its use. We safeguard authorization material within hireJudi, limit access to the connection, and use it only as the practice directs. Supported connections, routing methods, and technical requirements may change.

We do not use Service Data to train AI models, and our AI subprocessors have confirmed to us in writing that identifiable customer data, including any patient information, is not used to develop, train, fine-tune, or improve AI/ML models, and that processing and storage occur on US-based infrastructure. A subprocessor may use de-identified, aggregated data — data that no longer identifies any person or practice — to improve its own service. Our agreements prohibit selling or sharing Service Data. hireJudi itself never de-identifies or aggregates your practice's data for its own purposes.

Section 5 — Security

We build for HIPAA compliance as our baseline for all customer data: TLS everywhere, encryption at rest (including field-level encryption for the most sensitive fields), enforced MFA for HIPAA-enabled organizations, role-based access, tamper-evident audit logs, and PII redaction in call records. A fuller description is on our Security page. No system is perfectly secure; if a breach affects your information, we will notify affected practices and individuals as required by law.

Section 6 — Other disclosures

  • Legal process: we may disclose information when required by law, and where permitted we will notify the affected practice first.
  • Business transfers: if hireJudi is acquired or merged, this policy continues to apply to collected data; we will notify customers of changes.
  • Children: hireJudi is a business tool and not directed to children under 13. Practices may process minors' information as patients of the practice (Section 2), under the practice's control. Please be advised that hireJudi does not knowingly collect personal information directly from children under 13 through its own consumer-facing website or signup flow; when Judi collects intake information about a minor patient, it does so at the direction of, and on behalf of, the practice as part of the practice's own treatment relationship, not as an operator directed to children.

Section 7 — State privacy rights

  • Nevada: we do not sell "covered information" as defined by NRS 603A.300–360, and Nevada residents may submit opt-out-of-sale requests to the email below. Separately, Nevada's Consumer Health Data Privacy Act (NRS 603A.400–590) exempts entities subject to HIPAA at the entity level; for Service Data we process under an executed Business Associate Agreement, we rely on that exemption.
  • Other states: residents of other states may have additional rights under their state's privacy laws; contact us at the email below and we will honor applicable rights. This includes Washington, whose My Health My Data Act does not exempt HIPAA-covered entities or business associates at the entity level (only the protected health information itself is exempt) and is enforceable through a private right of action. For Service Data covered by an executed Business Associate Agreement, HIPAA's exemption applies to that PHI in Washington as elsewhere; for other consumer health data we may process, Washington and similar laws may require a separate consumer health data privacy notice and additional consumer rights (access, deletion, consent withdrawal) beyond what this policy currently provides. See our Consumer Health Data Privacy Notice.

Section 8 — Data Subject Requests

Depending upon the state in which you reside, you may have the following data subject rights, subject to certain limitations:

  • Right to Know and Access. The right to request that we disclose: (1) the categories of personal information we have collected about you; (2) the sources from which we collected the personal information; (3) the business or commercial purpose for the collection, selling or sharing of personal information; (4) the categories of third parties to whom we disclose personal information; (5) the categories of personal information that we sold or disclosed for a business purpose; and (6) the specific pieces of personal information we have collected about you.
  • Right to Portability. The right to request a copy of your personal information in a portable and readily usable format (to the extent technically feasible).
  • Right to Correction. The right to correct inaccuracies in your personal information, taking into account the nature and purposes of the processing of the personal information.
  • Right to Deletion. The right to delete your personal information provided to or obtained by us.
  • Right to Opt-out. The right to opt-out of certain types of processing, including:
    • To opt-out of the "sale" of your personal information.
    • To opt-out of targeted advertising by us.
    • To opt-out of any processing of personal information for purposes of making decisions that produce legal or similarly significant effects.

You can submit a data subject request by contacting us at hello@hirejudi.com. We reserve the right to verify your identity before processing your data subject request. Authorized agents may submit requests on behalf of California residents with appropriate documentation.

Section 9 — Changes and contact

We will post changes here and update the date above; material changes get email notice to account owners. Questions or requests: hello@hirejudi.com or the address above. Security & Privacy Official: Nathaniel Castillo.