Last Updated: May 14, 2026 · Effective Date: May 14, 2026
1. Overview & Who We Are
This Privacy Policy explains how SpecialtyDox LLC ("SleepDox," "we," "us," or "our"), the operator of the SleepDox brand at sleepdox.com, collects, uses, shares, and protects information when you visit our website, enroll as a patient, contact us, or receive SMS / text messages from us.
SleepDox provides sleep-medicine services including obstructive sleep apnea (OSA) evaluation, CPAP therapy management, cognitive behavioral therapy for insomnia (CBT-I), and remote therapeutic monitoring (RTM) — delivered through SpecialtyDox LLC and its affiliated licensed providers.
Plain-English summary: We collect the minimum information needed to provide your care, send you helpful text-message reminders, and bill your insurance. We do not sell your data. We do not share your phone number or SMS opt-in with anyone for marketing. Reply STOP to any text to opt out.
2. Information We Collect
2.1 Information You Provide Directly
- Contact information — name, mailing address, email, mobile phone number.
- Demographic information — date of birth, legal sex, preferred name, language preference.
- Health information — symptoms, sleep history, diagnoses, medications, allergies, insurance information, and other clinical data you share through intake forms, the patient portal, or during visits.
- Insurance & billing — member ID, group number, payer, guarantor information.
- Account credentials — encrypted password (if you register for the portal).
- Consent records — your opt-in to SMS messaging, HIPAA acknowledgments, and other consents you sign.
2.2 Information Collected Automatically
- Device and browser information (user agent, IP address, referrer).
- Usage data (pages viewed, links clicked, session timestamps).
- Cookies and similar technologies (see Cookies & Tracking).
2.3 Information from Connected Devices
- CPAP / APAP / BiPAP device data (usage hours, AHI, leak rates, pressure settings) — when you authorize device-data integration as part of CPAP compliance monitoring.
- Sleep diary entries, validated assessment scores (ISI, PHQ-2, etc.), and patient-reported outcomes.
2.4 SMS / Text Message Data
- Your mobile phone number (collected at intake, booking, or via web contact form).
- Your SMS opt-in record (timestamp, source of consent, IP if web-collected).
- The text content of messages exchanged between you and SleepDox.
3. How We Use Your Information
- Treatment — deliver clinical care, monitor your therapy, coordinate with your other providers.
- Payment — verify insurance, generate claims, collect copays and balances.
- Healthcare operations — schedule appointments, send reminders, run quality improvement.
- SMS communications — send appointment reminders, daily check-ins, CPAP compliance prompts, CBT-I coaching messages, lab results notifications, and other clinical messages you've opted in to receive.
- Customer support — respond to your questions, troubleshoot issues, fulfill requests.
- Legal & safety — comply with HIPAA, state law, and regulatory obligations; investigate suspected fraud or abuse; protect patient safety in emergencies.
- Service improvement — analyze de-identified usage trends to improve our platform.
We do NOT use your information, your mobile number, or your SMS content for advertising or marketing by third parties. We do NOT sell, rent, or trade any of your personal information or PHI.
4. SMS / Text Message Privacy (A2P 10DLC)
SleepDox sends SMS / text messages via Twilio Inc. from registered A2P 10DLC sender +1 (512) 675-6718. Our SMS program is registered with The Campaign Registry (TCR) under SpecialtyDox LLC.
Full SMS program details, sample messages, and the exact patient consent flow are documented at sleepdox.com/sms.
4.1 No Sharing of Mobile Information for Marketing
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All categories of mobile-originated data — including your phone number, SMS opt-in/consent status, and the content of text messages you exchange with SleepDox — are excluded from any information-sharing for marketing, advertising, lead-generation, or affiliate promotion.
Information sharing with subprocessors that operate the SMS service on our behalf (Twilio Inc., for message delivery; AWS for hosting; Anthropic, PBC for AI-assisted responses) is permitted strictly to deliver the service. These subprocessors are bound by written agreements (and, where applicable, Business Associate Agreements) that prohibit them from using your information for their own marketing purposes.
4.2 How You Opt In
You can opt in to receive SMS messages from SleepDox in any of the following ways:
- Patient intake form — by checking the SMS-consent box on our paper or digital intake form when you become a patient.
- Online appointment booking — by providing your mobile number and checking the SMS-consent box when you schedule a visit at sleepdox.com.
- Web contact form — by submitting a contact request on sleepdox.com with the SMS-consent checkbox selected.
- Verbal consent — by giving documented verbal consent to a SleepDox staff member during a phone call (we record the consent in your chart).
Each opt-in source presents this exact disclosure: "By providing my mobile number and checking this box, I consent to receive SMS / text messages from SleepDox (SpecialtyDox LLC) including appointment reminders, CPAP compliance prompts, daily check-ins, CBT-I coaching, and clinical follow-up messages. Message frequency varies. Message and data rates may apply. Reply STOP to opt out. Reply HELP for help. See our Privacy Policy and SMS Terms."
4.3 Categories of SMS Messages You May Receive
| Category | Examples | Frequency |
|---|
| Appointment | Reminders, confirmations, rescheduling, no-show follow-up. | Up to 4 per appointment. |
| CPAP Compliance / RTM | Daily usage check-ins, AHI alerts, supply reminders, mask-fit troubleshooting. | Up to 2 per day during active monitoring. |
| CBT-I Coaching | Sleep-diary reminders, sleep-window updates, weekly check-ins, ISI prompts. | Up to 2 per day during active treatment. |
| Clinical Follow-up | Lab results, post-visit questions, prior-authorization status. | As clinically needed. |
| Account & Billing | Statements, payment confirmations, balance reminders. | As needed. |
Overall message frequency varies by your clinical program and stage of care; most patients receive between 1 and 14 messages per week.
4.4 STOP, HELP, and Opt-Out
Reply STOP, END, QUIT, CANCEL, UNSUBSCRIBE, STOPALL, or REVOKE to any SleepDox text message to opt out of all non-emergency SMS communications. You will receive one confirmation message and then no further messages. Re-enroll at any time by replying START or by contacting us.
Reply HELP to receive support contact information.
4.5 Costs & Carriers
SleepDox does not charge for SMS messages. Message and data rates may apply based on your mobile plan. Supported carriers include AT&T, T-Mobile, Verizon Wireless, US Cellular, Boost, Cricket, MetroPCS, and most US-based MVNOs. Carriers are not liable for delayed or undelivered messages.
4.6 Privacy of Your Number
- Your mobile number is stored in our HIPAA-compliant electronic health record on AWS RDS (encrypted at rest with AES-256).
- Your number is used only to deliver the SMS communications you opted into and to authenticate you when you contact us.
- Your number is shared only with Twilio Inc. (our SMS carrier) and, where applicable under your care, with treating clinicians and authorized SleepDox staff.
- Your number is not shared, sold, or rented to data brokers, advertisers, affiliates, or any third party for marketing.
5. Information Sharing & Disclosure
We share information only in these limited circumstances:
- With your treating providers and authorized SleepDox staff — for treatment, payment, and healthcare operations consistent with HIPAA.
- With our service providers (subprocessors) — under written contracts and, where PHI is involved, Business Associate Agreements (BAAs). Current subprocessors include: Amazon Web Services, Inc. (hosting, database, storage, messaging); Twilio Inc. (SMS, voice, MMS delivery); Anthropic, PBC (AI text and voice agent responses); Deepgram, Inc. (speech-to-text and text-to-speech for voice calling); iFax (secure inbound and outbound fax transmission of clinical documents); Stripe, Inc. (payment processing, where used).
- With other healthcare providers — for care coordination at your direction or as permitted by HIPAA.
- With payers and clearinghouses — to verify eligibility, process claims, and obtain prior authorizations.
- With legal and regulatory authorities — when required by law (subpoenas, court orders, public health reporting, law enforcement requests that meet HIPAA's requirements).
- In an emergency — to prevent serious harm to you or others.
- In a business transition — if SpecialtyDox LLC is acquired, merged, or reorganized, your information may transfer to the successor entity under the same privacy protections.
We never share information with data brokers, marketing networks, advertisers, social-media platforms for advertising targeting, or anyone for SMS lead-generation. We never sell your information.
6. HIPAA & Protected Health Information
SpecialtyDox LLC operates as a Covered Entity and/or Business Associate under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the HITECH Act. Our use and disclosure of Protected Health Information (PHI) is governed by HIPAA and by our Notice of Privacy Practices, which is provided to all patients at intake and available upon request.
You may exercise your HIPAA rights — including the right to access, amend, restrict, and request an accounting of disclosures of your PHI — by contacting us using the information in Section 14.
In the event of a breach of unsecured PHI, we will notify affected individuals and, where required, the U.S. Department of Health and Human Services within the timeframes mandated by HIPAA.
7. Data Security
- TLS 1.2+ encryption for all data in transit (HTTPS).
- AES-256 encryption for data at rest on AWS RDS (PostgreSQL), AWS S3 (documents), and AWS DynamoDB.
- Hosting in AWS US-East-2 (Ohio) inside a HIPAA-eligible account with an executed BAA.
- Role-based access controls; principle of least privilege.
- Mandatory MFA for staff accounts with PHI access.
- Full audit logging of PHI access.
- Automatic session timeout on the patient portal and provider dashboards.
- Incident response plan with defined breach-notification procedures.
No system can be made 100% secure. You can help protect your information by using a strong unique password, enabling MFA, signing out of shared devices, and notifying us immediately of any suspected unauthorized access.
8. Data Retention
We retain medical records for the longer of (a) the period required by Texas state law, (b) HIPAA's six-year minimum, or (c) the period required by Medicare, Medicaid, or other payer contracts. We retain SMS opt-in records and message logs for at least the duration of your relationship with SleepDox plus 5 years thereafter for compliance and audit purposes.
Non-clinical web analytics data is typically retained for 14 months or less. You may request earlier deletion of non-PHI information you have provided through the website by contacting us; PHI deletion is subject to legal retention requirements.
9. Cookies & Tracking
sleepdox.com uses a small number of cookies and similar technologies:
- Strictly necessary cookies — to keep you signed in and to preserve session state. Cannot be disabled.
- Functional cookies — to remember your preferences (e.g., language, accessibility settings).
- Aggregate analytics — first-party, de-identified usage analytics. We do not use third-party advertising trackers and do not run pixels from Meta, TikTok, Google Ads, or similar advertising networks.
You can control cookies through your browser settings. Disabling cookies may prevent you from signing in or using portal features.
10. Children's Privacy
sleepdox.com is intended for adults (18+). We knowingly collect information about minors only when a parent or legal guardian establishes care on the child's behalf. We do not direct marketing to children under 13 and we do not knowingly collect personal information from children under 13 in violation of the Children's Online Privacy Protection Act (COPPA). If you believe a child under 13 has provided us information without parental consent, contact us at support@dox.care and we will delete it.
11. Your Rights & Choices
- Access — request a copy of the personal information we hold about you.
- Correction — ask us to fix inaccurate or incomplete information.
- Deletion — ask us to delete information that is not subject to legal retention.
- SMS opt-out — reply STOP to any text message, or contact us. Opting out of SMS does not affect your eligibility for treatment.
- Email opt-out — use the unsubscribe link in any non-transactional email.
- Complaints — file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr or 1-800-368-1019.
12. California Residents (CCPA / CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (as amended by the CPRA), including the right to know, delete, correct, and opt out of the "sale" or "sharing" of personal information. SleepDox does not sell or share personal information as those terms are defined under the CCPA. Most health information collected by SleepDox is exempt from the CCPA because it is regulated by HIPAA, but you may still exercise your rights with respect to non-PHI by contacting us at support@dox.care.
13. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last Updated" date at the top will reflect the most recent revision. Material changes will be communicated via the website, the patient portal, and (for active patients) via SMS or email. Your continued use of sleepdox.com after the effective date constitutes acceptance of the revised policy.