Defines personal data as any data that can identify or distinguish a person, varying by country; describes security as appropriate technical and organizational measures that vary by data type; and lists what people expect clarity and control over: what you collect, how you use it, where you store it and who you share it with. The EU, UK, Brazil and California flags signal that more regimes are coming.

The four questions in the bottom box are the columns of a data map. For Relay, a phone number plus 'your clinic has an opening' is health information about an identifiable patient, so the definition is met before any diagnosis appears.

Regulators care (GDPR with fines of up to 4% of global turnover, HIPAA for health data, FERPA for student data, the FTC and state attorneys general, California law); customers care because when you process data they control, they will diligence your practices and require contract terms; and trust in the brand depends on privacy and security.

The middle box describes Relay exactly: clinics are the HIPAA covered entities and Relay processes their patients' data, so every clinic will send a security questionnaire and require a Business Associate Agreement before go-live. Hospital outpatient departments add longer security reviews.

Incident readiness means knowing an incident happened (monitoring), knowing what to do (a runbook) and knowing who to tell within a short window (24 to 72 hours). For cloud services it asks about the vendor's security, whether it uses your data for its own purposes, how you get data back, where it is kept and what happens if governments request it.

The 24-to-72-hour window reflects GDPR's 72-hour regulator notice and contract terms. Under HIPAA, a business associate must notify the clinic without unreasonable delay and no later than 60 days after discovery, and BAAs often set shorter periods. The vendor questions apply directly to Relay's SMS gateway, cloud host and LLM provider.

Personal data is held about both employees and customers. The page lists GDPR-style legal bases (consent, contractual necessity, legitimate interest with notice and opt-out), key data-subject rights (access, objection and restriction, correction and erasure, portability, limits on automated decisions) and privacy by design, by default and by documentation.

These are EU-style concepts. For PHI that Relay handles as a business associate, HIPAA's rules on permitted uses and the BAA govern instead, and patients exercise access and amendment rights through the clinic. The design principle still applies: build deletion and minimal use from the start.

A checklist: data minimization (do you need all of it?), access control (only those who need it, with security and training), privacy by default, clear explanation of collection and use with ways to exercise rights, user controls such as opting out and restricting processing, and documentation in a GDPR Article 30 record of processing activities.

Map each item to a Relay control: minimum-necessary SMS content, role-based access to the patient list, opt-out handling that honors a STOP reply, and a written inventory of where PHI flows. The documentation habit is what lets Relay answer a clinic's security questionnaire in days rather than weeks.