Privacy Policy

1. Who we are

Pulse is an AI analytics and chat service operated by Midwest AI Systems Inc (“Midwest AI Systems”, “we”, “us”), located at 41528 Garden Way Dr, Sterling Heights, Michigan 48314, United States. Pulse helps businesses of any industry understand their own data: it answers questions in plain language, shows analytics and dashboards, and sends alerts.

This policy covers the Pulse web app (at pulse.midwestsystems.ai) and the Pulse mobile apps for Android and iOS.

2. Whose data this is

Pulse is sold to businesses, not to consumers. Most information in Pulse belongs to the business that uses it (“your organization”):

• Business data and chat content. Your organization decides which of its systems to connect and who may see what. We process this information on your organization’s behalf, under our agreement with it.
• Account and security records. We keep these to run, secure and support Pulse.

If your organization’s data includes information about its own customers or patients, your organization’s privacy notice explains how it uses that information. If you are one of those customers or patients, please contact that business first. We will help it respond.

3. What we collect

Account information

Your name, username and work email address; your password, stored only as a one-way hash; your two-step verification (MFA) setting, with its secret stored encrypted; your roles and access permissions; when you last signed in; and your preferences, such as notification settings.

Security and activity records

An audit log of sign-ins, failed sign-ins, sign-outs, account lockouts, two-step verification events, password changes and resets, and administrative changes. Each entry records who, what, when and the IP address it came from. The log also records every database query the AI assistant runs for you: the user, the database, the query text and the time.

Business data your organization connects

Data copied from the systems your organization connects, such as point-of-sale systems (for example Dutchie and Sweed), the Metrc track-and-trace system, and other systems it chooses to add. This can include sales, transactions, products, inventory, packages and lab results. Depending on the source and your organization’s settings, it can also include information about your organization’s own customers or patients, such as names, contact details, dates of birth, purchase records and, for healthcare customers, health identifiers. The sign-in keys for these systems are stored encrypted.

Chat content

Your questions and the AI’s answers, including data shown in those answers; feedback you give on answers (thumbs up or down and any comment); files you attach (such as PDF, Word, text, CSV and image files) and the text and search index made from them; and the dashboards and notes you save.

Voice input

If you use the microphone, your voice is recorded on your device and sent to us to be turned into text. The text is placed in your message box. We do not store the recording. The mobile app keeps it in memory and does not write it to your device’s storage. A transcription service processes the audio for us (see section 5).

Notifications

Pulse creates alerts from your organization’s data, such as a record day, an item out of stock or a sync delay, and shows them in the app. If you allow push notifications, we store your device’s push token, its platform (Android or iOS), the app version and when we last saw it.

Crash reports (mobile app)

If your organization’s Pulse server has crash reporting turned on, the app sends technical details of crashes to a crash-reporting server operated for that deployment. Before anything is sent, the app removes error messages and values, request details, user identity, extra data and the server name. What remains is technical: the type of error, where in the code it happened, device and app version, and the screens visited just before. Crash reporting is off when the server has not set it up.

Information stored on your device

• Web app: your browser’s local storage keeps your sign-in session and display preferences, such as the store you last picked.
• Mobile app: sign-in tokens are kept in the device’s secure storage. The server address and preferences, such as theme and selected store, are kept in app storage. The app’s data is excluded from Android cloud backup and device-to-device transfer.
• The mobile app asks for the microphone (voice input), photos (attachments), fingerprint or face (the optional app lock) and notifications, each only when you use that feature. It does not collect your location or advertising identifiers.

4. How we use information

• To provide Pulse: answering questions, building analytics and dashboards, creating alerts and delivering notifications.
• To keep Pulse secure: signing you in, enforcing permissions, detecting and stopping misuse, and keeping audit records.
• To support and fix Pulse: investigating problems with crash reports and AI traces (see section 5), and using your feedback on answers and alerts to decide what to improve.
• To meet legal duties: keeping records the law requires and responding to lawful requests.
• To communicate with you: service emails such as password-reset codes, and alerts your organization turns on.

We do not sell personal information. We do not use it for advertising, and we do not share it for cross-context behavioral advertising.

We do not use your organization’s data, your chat content or your feedback to train or fine-tune AI models. Under their business terms, OpenAI and Microsoft Azure OpenAI do not use data sent to them through their APIs to train their models.

5. How the AI handles your data

To answer a question, Pulse sends the question, the conversation so far and the data needed for the answer to an AI model provider. The assistant can only read data. It cannot change or delete anything in your organization’s databases. It can only see the databases your account is allowed to see.

If your account can reach health information

Your organization’s databases can be marked as containing protected health information (PHI). If you can reach any such database:

• All AI processing goes only to Microsoft Azure OpenAI in a US region, under Microsoft’s Business Associate Agreement. This covers answers, the search index for attachments, voice transcription and reading images.
• It never goes to the public OpenAI service, even as a fallback. If the approved service is unavailable, the request is refused.
• The web-search tool is turned off.
• Your conversations are not recorded in our AI tracing tool.
• Two-step verification is required when you sign in.

All other accounts

• AI processing is done by OpenAI or by Microsoft Azure OpenAI, depending on how the service is configured. Voice transcription is done by OpenAI.
• For questions about public information, such as current events, the assistant may search the web through DuckDuckGo. The search words are written by the AI and may reflect your question. The assistant is instructed not to use web search for anything it can answer from your own data.
• To find and fix problems with answers, we record AI requests and responses in a tracing tool that runs on our own servers (Langfuse). Before a trace is stored, email addresses, phone numbers, Social Security-style numbers, payment card numbers, passwords, keys and database connection details are masked. Traces are deleted after 30 days.

6. Health information (HIPAA)

Some of our customers are subject to HIPAA. When we handle protected health information for them, we act as their business associate. We sign a Business Associate Agreement (BAA) with the customer before we process its PHI. The BAA governs that information, and it prevails over this policy if the two differ.

• Our hosting provider, Microsoft Azure, and Azure OpenAI are covered by Microsoft’s BAA with us.
• We do not send PHI to AI services that are not covered by a BAA (see section 5).
• Push notifications never carry PHI, and crash reports are cleaned of content before they are sent.
• Pulse holds a copy of data synced from the customer’s own system. To delete one person’s record for good, the customer deletes it in that system, and the change reaches Pulse on the next sync.

If you are a patient, please contact your healthcare provider about your health information.

7. Service providers and other sharing

We share information only with the service providers below, and only so they can do their part in running Pulse.

Microsoft Azure

Hosting (US East region), encrypted backups (West US 2 region), key storage, and Azure OpenAI for AI processing. Covered by Microsoft’s BAA.

OpenAI

AI answers, search indexing, voice transcription and image reading, for accounts that cannot reach health information. Never used for health information.

Google Firebase Cloud Messaging

Delivers push notifications. It receives your device’s push token and a short message such as “A win at store name” or “Store name needs a look”, plus an internal ID. Messages never include figures or health information; details load inside the app after you open it.

Apple Push Notification service

Delivers push notifications to iPhones and iPads, through Firebase, with the same content limits.

DuckDuckGo

Web searches by the AI assistant, for accounts that cannot reach health information (see section 5).

Email delivery provider

Sends service emails, such as password-reset codes and confirmations, and alerts your organization turns on.

Your organization’s connected systems

Such as Dutchie, Sweed and Metrc. We read data from them with the keys your organization provides. Your organization’s own agreements with those companies govern the data they hold.

Our database, document search index, file storage, AI tracing and crash-reporting tools run on servers we operate, not on outside services. Let’s Encrypt issues our website security certificates and receives no personal information.

We may also share information:

• with your organization’s administrators, who manage accounts and permissions and can review activity records;
• when the law requires it, or to protect the rights, safety and security of our customers, users or us;
• as part of a merger, acquisition or sale of assets, subject to this policy and our customer agreements.

8. Where data is stored

Pulse runs on Microsoft Azure in the United States: the service is in the US East region, and encrypted backups are copied to the West US 2 region. Azure OpenAI processing for health information takes place in a US region. OpenAI processes data in the United States and other countries where it and its service providers operate, under its API data terms. OpenAI may keep data it receives for up to 30 days to detect abuse, and then deletes it.

If your organization uses its own dedicated Pulse server, its data is stored where that server runs, as set out in its agreement with us.

9. How long we keep information

• Accounts: while the account exists. An administrator can deactivate an account, which stops sign-in and keeps its data. An administrator can also erase it permanently, which removes the user and all of their conversations, attachments and saved AI state.
• Conversations: until you delete them. Deleting a conversation permanently removes its messages, attachments and search index. Your organization can also agree with us that conversations are deleted automatically after a set period without activity.
• Voice recordings: not stored.
• AI traces: 30 days.
• Audit and security records: at least 6 years.
• Password-reset codes: 15 minutes, kept only in scrambled (hashed) form.
• Push tokens: until you sign out on that device, or until the push service tells us the token is no longer valid.
• Notification feed: alerts are kept while the data source they came from stays connected. Your copy of each alert is removed when your account is erased.
• Business data: for as long as your organization uses Pulse, and as its agreement provides. When a customer leaves, we delete its data under our documented offboarding procedure.
• Backups: encrypted daily backups are kept for 30 days and cannot be altered or deleted early. Deleted data is therefore fully gone about 30 days after deletion, once the last backup containing it expires.

10. How we protect information

• Encryption in transit (TLS) for all connections to Pulse. Encryption at rest for stored data and backups, with stored keys and connection details encrypted again by the application.
• Each customer’s data is kept in its own separate database. Role-based permissions limit each user to what they are allowed to see.
• The AI assistant has read-only access.
• Strong password rules, two-step verification (required for anyone who can reach health information, and for administrators where required), account lockout after 10 failed attempts in 15 minutes, and automatic sign-out after 30 minutes without activity.
• Audit logging of sign-ins, administrative changes and data access.
• In the mobile app: tokens in secure device storage, no cloud backup, screen contents hidden in the app switcher, and an optional app lock with fingerprint, face or passcode.

No system is perfectly secure. If we learn of a security incident that affects your information, we will notify you, or your organization, as the law and our agreements require.

11. Your choices and rights

• Notifications: turn push notifications on or off in Account → Notifications, or in your device settings. You can also mute particular kinds of alerts.
• Device permissions: microphone, photos, biometrics and notifications can be turned off at any time in your device settings.
• Your conversations: you can delete any of your conversations in the app.
• Access, correction, deletion and copies: depending on where you live, you may have the right to ask for these. Because your organization controls most data in Pulse, we may pass your request to it, or act on its instructions. If we decline a request, you can ask us to reconsider by replying to our decision.

To make a request, email info@midwestsystems.ai. We may need to confirm your identity first. We will not treat you differently for using your rights.

12. Children

Pulse is a business service for authorized adult users. It is not intended for children, and we do not knowingly collect information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.

13. Changes to this policy

We may update this policy as Pulse changes. We will post the new version here with a new “Last updated” date. If a change is significant, we will also tell you in the app or by email before it takes effect.

14. Contact us

Midwest AI Systems Inc
Attn: Privacy Officer
41528 Garden Way Dr
Sterling Heights, MI 48314
United States
Email: info@midwestsystems.ai