Privacy Policy

1. Who we are

BoomLink Health is a service of The Boom Company, Inc., doing business as Boom Logic ("Boom Logic", "we", "us"), a California corporation located at 1106 Colorado Blvd, Los Angeles, CA 90041. BoomLink Health lets clinics hold temporary, secure conversations with their patients.

This policy covers three groups of people: visitors to our website, clinic staff who use BoomLink Health, and patients who receive messages from their clinic through it.

2. Website visitors and the interest form

When you fill in our "Get started" form, we collect your name, work email, phone number (if you give it), organization, role, number of locations, the EHR you use and any message you write, along with the time you agreed to be contacted. We use this only to respond to your request and discuss BoomLink Health with you. Please don't include patient information in the form.

Our website doesn't use advertising, analytics or tracking cookies, and it loads no third-party scripts. Like most websites, our hosting provider processes technical data such as IP addresses to deliver pages and protect against abuse. We use your IP address briefly to limit repeated form submissions; we don't store it with your request.

3. Clinic staff accounts

For staff accounts we process name, work email, role, the locations a person can access, and sign-in and activity records (for example, when a session was started or a message was sent). Staff sign in through their organization's Microsoft 365 account; we don't receive or store their Microsoft password. We use this information to provide the service, keep it secure, keep audit records and support the clinic.

4. Patient information we process for clinics

Patient information in BoomLink Health (such as name, date of birth, mobile number, messages, attachments, appointment details and intake form answers, including information exchanged with the clinic's EHR) is protected health information that we process on behalf of the clinic. The clinic is the covered entity and controls that information; we act as its business associate under a Business Associate Agreement (BAA) and HIPAA. We use and disclose it only to provide the service to the clinic, as the BAA and the law allow.

If you're a patient and have questions about your information, or want to access or correct it, please contact your clinic. We'll help the clinic respond.

5. Text messages

Clinics use BoomLink Health to send you a text that contains only the clinic's name, a secure link and when the link expires. These texts are sent at your clinic's request. Reply STOP to opt out of texts from that clinic's BoomLink Health number. Message and data rates may apply. We don't use phone numbers for marketing and we don't share them for others' marketing.

6. We do not sell or share personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We show no ads. We share information only with service providers that help us run BoomLink Health (for example, hosting, database, text-message delivery and translation providers) under contracts that limit their use of it, when the law requires it, or with the clinic that controls it.

7. How we protect information

We use administrative, technical and physical safeguards, including encryption of messages, attachments, dates of birth and phone numbers in storage, HTTPS for every connection, date-of-birth checks before a patient conversation opens, access limited by role and location, automatic sign-out after inactivity, and an append-only audit log. No system is perfectly secure, but we work to protect your information and will notify clinics and others as required by law and our agreements.

8. Retention

Patient conversations are temporary: each link and session expires on a schedule the clinic sets, and the clinic's EHR is the record of care. We keep session data only as long as needed to provide the service, meet the clinic's instructions, our BAA and legal obligations, and keep required audit records. We keep interest-form submissions for as long as needed to follow up on your request and our business relationship, then delete them.

9. Children

Our website is not directed to children under 13, and we don't knowingly collect personal information from them through it. Patient information about minors is handled for the clinic under its BAA.

10. Your California privacy rights

If you're a California resident, you may have rights under the California Consumer Privacy Act, as amended by the CPRA, where it applies: to know what personal information we collect and how we use it, to request access to it, to correct it, to delete it, and not to be discriminated against for using these rights. We don't sell or share personal information, so there is nothing to opt out of. Protected health information we process for clinics is governed by HIPAA and handled through your clinic. To make a request, contact us as described below; we may need to verify your identity, and you can use an authorized agent.

11. Changes to this policy

We may update this policy. We'll change the "Last updated" date above and, for significant changes, give notice on this site or to clinics directly.

12. Contact us

Questions or requests about this policy: use our contact form or write to: