Privacy Policy
Last updated: July 2026
Overview
Echo Health (“Echo”, “we”, “us”) provides technology that enables healthcare organizations to improve communication, care coordination, and patient engagement. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your information.
Echo operates in two modes: Self-Care Mode (personal wellness, no provider connection) and Patient-Care Mode (connected to a licensed healthcare provider with your consent). Your data handling depends on your operating mode and consent choices.
Data We Collect
Email address, name, and authentication credentials to identify you and secure your account.
Journal entries, mood logs, care plan interactions, and app usage patterns you choose to record.
Your consent decisions (granted, revoked, or pending) for each data purpose, including timestamps and your explicit choices.
System logs of data access, consent changes, and feature usage for security, compliance, and your own transparency.
If your healthcare provider enrolls you in a care plan with SMS check-ins, your mobile phone number is collected during enrollment and used exclusively for sending care-plan-related text messages.
SMS Text Message Communications
Echo Health may send SMS text messages to patients enrolled in a care plan by their healthcare provider. These messages are care plan check-ins — not marketing or promotional messages.
Your mobile phone number is used exclusively to send care plan check-in messages. We do not sell, share, or distribute your phone number to third parties for marketing or any purpose unrelated to your care. Your phone number is not shared with other organizations on our platform.
During enrollment in the Echo Health mobile app, you are presented with a dedicated SMS consent section. You must actively check an unchecked checkbox to agree to receive SMS check-in messages. Your consent is recorded with a timestamp. Echo sends care-plan-related messages only. No messages are sent without your explicit consent.
Message frequency varies based on your care plan and your provider's instructions. Your active care plan period is typically 30 days.
Reply STOP to any message to stop receiving SMS check-ins. You will receive one confirmation message and no further texts. Opting out does not affect your care plan or your relationship with your provider.
Reply HELP to any message for assistance, or contact us at [email protected].
Message and data rates may apply. Echo Health does not charge for SMS messages, but your mobile carrier may apply standard messaging fees.
For more details about our SMS messaging practices, see our SMS Messaging Policy.
Consent Enforcement and Revocation
Echo uses purpose-based consent. You choose what data is shared and for what purpose:
- Care coordination: sharing with your care team (Patient-Care Mode only)
- SMS check-ins: receiving care plan follow-through messages via text (Patient-Care Mode only)
- AI wellness support: personalized guidance based on your data
- Research: de-identified contribution to health research (optional)
For SMS messaging: You provide explicit consent by checking an unchecked SMS consent checkbox in the Echo Health mobile app during enrollment. Echo sends care-plan-related check-in messages only after this consent is recorded. You can reply STOP to any message to opt out at any time.
You can revoke consent at any time from Settings in the mobile app, by replying STOP to any SMS message, or by contacting your healthcare provider. Revocation takes effect immediately. Previously shared data under valid consent remains part of the care record where clinically necessary.
Data Export and Deletion Rights
You have the right to:
- Export your data: request a copy of your account data, journal entries, and consent history
- Delete your account: request permanent deletion of your account and associated data
- Correct inaccuracies: update or correct your personal information
To exercise these rights, contact us at [email protected]. We respond to requests within 30 days.
For detailed instructions on account deletion, see our Account Deletion page.
Tenant Isolation (Multi-Organization Security)
Echo serves multiple healthcare organizations (“tenants”). Your data is strictly isolated to your tenant:
- Data from one organization cannot be accessed by another
- Each tenant has separate encryption keys and access controls
- Cross-tenant data sharing is technically prevented at the infrastructure level
Self-Care Mode vs Patient-Care Mode
Personal wellness tools. Your data stays private to you. No provider access. Features: journaling, mood tracking, AI reflections.
Connected to a licensed provider with your consent. Additional features: telehealth, secure messaging, medication management.
Security
We protect your data with:
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Role-based access controls
- Audit logging for all data access
- Regular security assessments
Contact Us
For privacy questions, data requests, or concerns:
Email: [email protected]
General support: [email protected]
Changes to This Policy
We may update this policy to reflect changes in our practices or legal requirements. Material changes will be communicated via the app or email. Continued use after changes constitutes acceptance.