About this policy
Public Inc., doing business as Autumn ("Autumn," "we," or "us"), provides billing and revenue cycle services for dental practices in the United States. This Privacy Policy explains how we handle personal information when you visit meetautumn.com, request a demo or audit, communicate with our team, or use an Autumn account.
"Personal information" means information that identifies a person or can reasonably be linked to a person. It includes business contact information, not just information about someone in their personal life.
Two different roles
For our website, sales activities, and business administration, Autumn determines how personal information is used. For patient records and other information we process on behalf of a practice ("Practice Data"), the practice directs our work. Our customer agreements, applicable Business Associate Agreements (BAAs), and applicable law govern that processing.
The Practice and patient data, AI and your data, and Retention and deletion sections explain that relationship. This policy does not replace a practice's notice of privacy practices or authorize new uses of patient information.
Information we collect
We collect different information depending on the service you use and your relationship with Autumn.
Information you or your practice provide
- Business contact details. Your name, email address, phone number, role, practice name, number of locations, and information about the practice's software and service needs.
- Account and access information. Your account identifiers, authentication information, practice memberships, permissions, and account preferences.
- Communications and support. Messages, attachments, feedback, and information you provide when speaking with our team or requesting help.
- Business relationship records. Service agreements, onboarding records, signatures, billing contacts, and records of transactions with Autumn.
Information collected automatically
We collect technical information such as IP address, device and browser type, operating system, timestamps, referring pages, advertising identifiers, and information about pages and features used. Usage and diagnostic information helps us understand performance, identify errors, and protect accounts. Our website also uses the technologies described in Cookies and advertising.
Information from other sources
We may receive information from a practice administrator who creates or manages your access, a person who refers your practice to Autumn, or an advertising platform through which you submit an inquiry. We may also use public practice websites and professional directories to understand a business inquiry and confirm practice information.
Patient records, insurance documents, and information from connected practice systems are described separately below. Please do not submit patient information through public demo or marketing forms.
How we use information
We use the personal information described above for the following purposes:
- Provide services. Set up accounts, manage practice access, complete onboarding, deliver requested services, and maintain our customer relationship.
- Respond and communicate. Arrange demos and audits, answer questions, provide support, and send service, account, billing, or security notices.
- Operate and improve Autumn. Diagnose errors, assess feature performance, and improve website usability and support processes. This does not permit model training on Practice Data.
- Market our services. Follow up on business inquiries and measure the effectiveness of our website and advertising, subject to applicable choices and requirements.
- Protect people and systems. Authenticate users, investigate suspected misuse, maintain access records, and prevent unauthorized activity.
- Meet business and legal obligations. Administer contracts, maintain required records, resolve disputes, and respond to valid legal requests.
Our uses of Practice Data are limited by the customer relationship described in the next section. A general reference to improving Autumn does not expand our rights to use patient records.
Practice and patient data
Practices give Autumn access to information needed for their selected services. This may include patient identifiers and contact details, insurance coverage, procedure and claim information, explanations of benefits, remittances, payment records, and relevant supporting documents. Some of this information is protected health information under HIPAA.
Where it comes from and why we use it
Practice Data may come from a practice-management system, an authorized integration such as Sikka, documents supplied by the practice, or insurance and payment services used for the requested workflow. Where a practice connects a business bank account, relevant deposit and transaction information can support reconciliation.
We process this information to perform the services requested by the practice, such as insurance verification, claim review and follow-up, remittance reconciliation, payment posting, and receivables audits. Access depends on the practice's setup, user permissions, and enabled services.
Instant Payments
For practices that use Instant Payments, we process relevant practice, claim, and transaction information to administer the agreed service. The applicable customer agreements govern the transaction and related data use. This policy does not itself authorize access to additional patient records or a new financial transaction.
Requests about patient records
If you are a patient, contact your dental practice to request access to, correction of, or deletion of your records. The practice determines how to respond under its obligations; we assist it as required. An individual account user's request is not authority to delete all of a practice's records.
AI and your data
Autumn uses a self-hosted model for document processing and may use contracted providers, including OpenAI and Anthropic, for applicable AI features. Information sent to a provider depends on the feature and can include relevant document content, instructions, and the resulting output. A self-hosted model does not mean that every Autumn feature runs entirely within the practice.
We do not use Practice Data, including patient information, submitted documents, and related AI inputs and outputs, to train AI models. We do not permit our AI service providers to use that data to train their models.
We do not sell Practice Data to AI providers. AI providers that handle protected health information are covered by applicable BAAs. Using information to produce a requested result is distinct from using it to train a model.
No-training restrictions and data retention are separate controls. Information may still need to be processed or stored to deliver a feature. The applicable provider agreements, configured services, and our retention obligations govern that handling.
Retention and deletion
Practice Data
We retain, return, and delete Practice Data in accordance with the applicable customer agreement, BAA, and law, including when a practice stops using Autumn. An authorized practice representative may request deletion at privacy@meetautumn.com. We verify the request and the representative's authority before acting on it.
These obligations apply to Practice Data held by Autumn and providers acting on our behalf. Deletion from Autumn does not delete original records held by the practice or independently by an insurer, bank, or other organization.
Business contact and website information
We keep this information while needed to provide services or fulfill the purposes described in this policy. Retention also accounts for legal duties, disputes, enforcement of agreements, and tax, accounting, and audit requirements. We consider the information's sensitivity, the risks of keeping it, and whether the purpose can be met without it.
You may ask us to delete your personal information or stop marketing communications. We may retain a limited record of an opt-out so that we can continue to respect it.
Deletion and backup copies
When retention is no longer needed or required, we delete the information or, where our agreements and applicable law permit, anonymize it. If deletion must wait, including for backup copies, we protect the retained information and restrict further use until deletion is possible. Practice Data remains subject to the customer agreement, BAA, and law during that period; this section does not extend any retention period they require.
Security and access
We use administrative, technical, and organizational measures designed to protect information from unauthorized access, misuse, loss, and disclosure. These include controls for account access and practice permissions and safeguards for data transmission and storage. The controls that apply depend on the service and the type of information.
Keep your account credentials private and tell us if you suspect unauthorized access. Please do not include patient records, passwords, or other sensitive material in an initial privacy inquiry; we can arrange an appropriate way to handle information needed for the request.
No transmission method or storage system is completely secure. Our customer agreements and applicable law govern incident-notification obligations.
Your privacy choices
Marketing communications
To stop marketing emails, use an unsubscribe option where provided, reply to the message, or email privacy@meetautumn.com. You can also ask us to stop marketing calls or texts. Opting out of marketing does not stop necessary messages about an active account, a transaction, or a security issue.
Website measurement
You can change your choice for optional analytics and advertising measurement. Browser choices apply to the browser and device where they are set. Clearing browser storage or using another browser may require you to set your choice again. Blocking essential cookies can affect site functions.
Choose whether to allow optional measurement on this browser.
Measurement controls are loading. You can also email us about your privacy choices.
Requests that go beyond this browser
For a request concerning your contact details, marketing records, or advertising-related disclosures outside this browser, email privacy@meetautumn.com. Tell us the email address or other business contact information relevant to your request, without sending patient records.
Your privacy rights
Depending on where you live, the information involved, and the law that applies to Autumn, you may have rights to:
- Learn whether we process information about you and obtain access to it.
- Receive an available copy in a usable, portable format.
- Correct inaccurate information or request deletion.
- Opt out of a sale or sharing of information, targeted advertising, or certain automated decisions where those activities and rights apply.
- Withdraw consent where processing relies on your consent.
- Appeal a decision about your request where the law provides that right.
These rights can have limits and exceptions. We will not discriminate against you for exercising applicable privacy rights.
How to make a request
Email privacy@meetautumn.com with the request and enough information to identify your relationship with Autumn. We may verify your identity or, for a practice request, your authority to act. Where permitted, an authorized agent may submit a request; we may ask for proof of authorization.
We respond within the period required by applicable law. If a request cannot be completed in full, we explain the reason as required. To appeal a response where available, reply to it or email us with the subject "Privacy request appeal." You may also contact the relevant state privacy regulator.
For California residents, applicable rights can include information about the categories, sources, purposes, and recipients of personal information and any sale or sharing. The collection, use, and sharing sections describe these activities. These statements do not mean that every provision of every state privacy law applies to Autumn or every record it handles.
Patient-record requests should go to the dental practice, as explained in Practice and patient data.
Other websites and service scope
Autumn offers its services to practices in the United States. Our website may be accessible elsewhere. The location of a customer does not, by itself, establish where a provider stores or processes information; applicable customer and provider agreements govern those arrangements.
Links and integrations may take you to a service operated by another company. That company's privacy notice governs information it collects for its own purposes. This does not remove Autumn's obligations for providers processing information on our behalf.
Children's privacy
Our public website and business accounts are intended for adult business users. We do not direct these offerings to children or knowingly collect personal information directly from children under 13 through them. If you believe a child has provided information through our website, please contact us.
This is separate from pediatric patient information a dental practice authorizes us to process. That information remains subject to the practice relationship, applicable BAAs, and law.
Policy updates
We may revise this policy as our services, practices, or legal obligations change. The date at the top identifies the current version. For material changes, we provide additional notice where required by law.
Updating this page does not itself authorize uses of Practice Data outside our customer agreements or replace consent where consent is required.
Contact us
For questions about this policy, a privacy request, or a concern about how we handle information, contact:
Public Inc., doing business as Autumn
privacy@meetautumn.com
Please include your name, your practice or business relationship if applicable, and a short description of your request. Do not include patient information or account passwords in your initial message.