Controlled pilot data policy
Version business-non-phi-v1. This is the pilot operating boundary, not a healthcare deployment approval or an independently reviewed privacy notice.
What belongs in the CRM
Business contact details, professional relationships, organizations, projects, commitments and necessary business correspondence. Limit confidential coaching and personnel notes to what the work requires and assign access carefully.
What stays out
Identifiable patient or resident health, treatment or payment information; clinical records; passwords; government identifiers; and full payment-card details. Integration credentials belong only in designated connection settings. Removing a name does not by itself establish de-identification.
Before enabling imports
The workspace owner must review connected email accounts, calendar content and Fathom meetings. Select appropriate source material and avoid sources containing prohibited information. The 30-day email window limits volume, not sensitivity. Automated detection is not a guarantee. Pausing an import does not remove data already stored.
Accountable operating decisions
- Name the security/privacy owner and maintain an approved-user register.
- Inventory data flowing through hosting, Microsoft, Google, Fathom, Relationship Compass, AI services, storage, logs and backups; include only providers actually enabled.
- Approve a documented retention schedule, deletion process, export process and incident response contact. No new automatic retention or deletion schedule is established by this release.
- Verify provider encryption, secret management, backup retention, recovery, recording notices, consent requirements and applicable contracts.
- If prohibited information is discovered, pause the affected source, restrict access and notify the designated owner. Follow a reviewed removal and incident process; do not copy the information into support or audit notes.
Healthcare deployment remains blocked
Before permitting PHI, obtain review of the exact hosting product, processors, required agreements and operational safeguards. Policy acknowledgment cannot establish HIPAA compliance, vendor support, or encryption and recovery evidence.