Trust Center

Security, Privacy, and Compliance for Dental Groups and DSOs

Needletail Inc. ("Needletail", "we", "us") is committed to protecting the confidentiality, integrity, and availability of the information entrusted to us by growing dental groups and DSOs. This Trust Center describes our security, privacy, and compliance posture and explains how we safeguard your data across our AI‑powered, fully managed eligibility verification and RCM Services.

For any questions, or to request a Business Associate Agreement (BAA) and security documentation, contact us at legal@needletailai.com

Security

Needletail's security program is designed around industry‑standard controls for healthcare SaaS platforms, with a focus on HIPAA and SOC 2 Type 2 alignment.

Secure Infrastructure

• Hosted on leading cloud infrastructure (such as AWS) with network segmentation, hardened services, backups, and disaster‑recovery mechanisms appropriate for healthcare data.
• Use of secure connectivity, firewalls, and monitoring to protect environments from unauthorized access.

Encryption & Data Protection

• Encryption of data in transit using modern TLS (for example, TLS 1.2+), and encryption of data at rest using strong industry‑standard algorithms (for example, AES‑256 or equivalent).
• Strong key‑management practices in line with cloud‑provider and security best practices.

Access Control & Identity Management

• Role‑based access controls (RBAC) and least‑privilege principles for all internal and customer‑facing systems.
• Strong authentication requirements, including multifactor authentication and secure access workflows for Needletail personnel with production access.

Application & Vulnerability Management

• Secure development lifecycle practices, including code review, dependency management, and testing.
• Regular vulnerability scanning and remediation activities, and the use of security tooling to monitor and manage risks.

Monitoring, Logging, and Incident Response

• Centralized logging of key application and infrastructure events, with monitoring for anomalies and potential security incidents.
• Documented incident‑response procedures for triage, containment, investigation, remediation, and communication, including HIPAA breach‑notification obligations where applicable.

Compliance

Needletail focuses on U.S. dental practices, group practices, and DSOs and operates as a HIPAA‑aligned, cloud‑based Business Associate.

HIPAA

• Needletail acts as a Business Associate to Covered Entities and other HIPAA‑regulated customers and signs a Business Associate Agreement (BAA) with every such customer.
• PHI is used only as permitted by HIPAA, the BAA, and customer instructions; PHI is not used for Needletail's own marketing or for third‑party advertising.

SOC 2 Type 2 (in progress)

• Needletail is in the process of aligning controls and evidence for SOC 2 Type 2 attestation and is building its security program around the applicable Trust Services Criteria (such as security, availability, and confidentiality).
• Once available, a SOC 2 Type 2 report or summary will be provided to customers under appropriate confidentiality protections.

Other Regulatory Considerations

• Needletail monitors applicable U.S. healthcare and data‑protection requirements and updates its practices as laws and regulations evolve.
• For specific regulatory or contractual needs, Needletail works with customers through the MSA/BAA process.

Privacy & Data Handling

Needletail maintains a separate Privacy Policy that describes in detail how we collect, use, and disclose information in connection with our Website and Services. You can access it from our legal section.

Key principles for PHI and customer data:

Roles & Responsibilities

• For PHI and other patient data processed as part of the Services, Needletail acts as a Business Associate/processor on behalf of the customer, who remains the Covered Entity or controller.
• For website visitors and marketing contacts, Needletail acts as an independent entity and processes limited business and technical data as described in the Privacy Policy.

Data Flows & Usage

• Needletail connects to cloud practice management systems, payer portals, and other integrated systems to retrieve and process eligibility and benefits information on behalf of customers.
• PHI is accessed and used only to perform contracted eligibility verification and related RCM services, quality assurance, and security and operational needs as allowed by the BAA and applicable law.

De‑identification and Analytics

• When permitted by contract and law, Needletail may use de‑identified or aggregated data for analytics, service improvement, and model refinement, consistent with HIPAA de‑identification guidelines and customer agreements.
• De‑identified and aggregated data does not identify individual patients, users, or customer organizations.

Data Residency & Access

• Primary production infrastructure is hosted in the United States, with PHI stored in U.S. data centers.
• Needletail may have engineering and support personnel outside the US with carefully controlled and logged access, subject to confidentiality obligations and data‑protection agreements, and in a manner consistent with customer contracts and applicable law.

AI & Quality Assurance

Needletail uses multiple AI agents and structured workflows to deliver fast and accurate eligibility verification and RCM services to dental groups and DSOs.

AI in the Eligibility Workflow

• AI agents interact with payer portals, process documents, and support voice‑based interactions, under strict access and security controls.
• AI components are designed to operate only within the scope required to perform eligibility verification and RCM tasks for each customer.

Human Oversight & Near‑Zero‑Error Goals

• Every eligibility verification workflow is supported by two stages of human quality assurance to validate AI‑generated outputs, with the goal of achieving near‑zero‑error eligibility forms delivered into customer practice management systems.
• Customers remain responsible for clinical decisions, billing choices, and payer interactions; Needletail's outputs support, but do not replace, professional judgment.

Model Improvement & Data Protection

• Needletail does not use PHI to train third‑party foundation models for their own purposes.
• De‑identified, aggregated, or non‑PHI data may be used to improve Needletail's own models and workflows when allowed by MSA/BAA and applicable law.

Subprocessors & Infrastructure Partners

Needletail works with carefully selected subprocessors and infrastructure partners to deliver the Services at scale and with high reliability.

These partners fall into categories such as:

• Cloud hosting and infrastructure (for example, AWS).
• Content delivery, network security, and bot/abuse protection tools.
• Email and communication services for system notifications and customer communications.
• Analytics and observability platforms that help us monitor performance and reliability.
• Customer relationship management and support systems for onboarding and service.

Where a subprocessor may access or process PHI, Needletail requires contractual commitments and security controls appropriate for Business Associates, including data‑protection obligations and, where applicable, HIPAA‑aligned terms.

If you would like a current list of subprocessors or more detail on specific services, you can request it by contacting us at legal@needletailai.com

Business Associate Agreement (BAA) & Security Document Requests

Needletail signs a HIPAA Business Associate Agreement with every Covered Entity (or appropriate HIPAA‑regulated customer) using our Services for PHI.

You can request:

• A Needletail BAA template for review and signature.
• Security documentation (for example, security overview/whitepaper, SOC 2 Type 2 report once available, or a summary of security controls).

BAA & Security Request Form

To request a BAA or security documentation, please provide the following information by contacting us at legal@needletailai.com:

Organization Information

• Legal entity name
• Doing business as (DBA), if any
• Number of locations (range)
• Primary practice management system(s)
• Primary state(s) of operation

Primary Contact

• Name
• Role/title (for example, Compliance Officer, COO, RCM Lead)
• Work email
• Work phone

Contracting Details

• Are you a Covered Entity or a Business Associate?
• Are you already in discussions with Needletail (MSA or pilot)?
• Name and title of intended signatory for the BAA

Intended Use

• Eligibility verification
• Eligibility + additional RCM workflows
• Approximate monthly verification volume (ranges) – optional

Requested Documents

• Needletail BAA template
• Security overview / security whitepaper
• SOC 2 Type 2 report / summary (once available)

Contact & Reporting

If you have questions about Needletail's security, privacy, or compliance practices, or wish to report a security concern, please contact:

Needletail Inc.
8 The Green, Suite A
City of Dover, County of Kent
Delaware 19901, USA
Email: legal@needletailai.com

If you believe you have discovered a security vulnerability affecting Needletail, please provide a description of the issue, steps to reproduce (without sharing PHI), and your contact details so we can follow up.