Privacy Notice

Last updated: June 25, 2026

1. Who we are

Superbill Studio is operated by Holistic Business Solutions Inc. ("we", "us", "our"), which acts as the data controller for personal data processed through this service. You can contact us at privacy@holisticbusinesssolutions.com for any privacy-related question.

2. Personal data we collect

• Account data: name, email address, password hash, organization details.
• Practice data: provider information, patient and billing records, clinical codes you enter.
• Usage and device data: log data, IP address, browser type, pages viewed, timestamps.
• Support data: messages and attachments you send to us.
• Payment data: processed by Paddle (our Merchant of Record). We receive limited transaction metadata (order ID, amount, status) but do not see full card details.

3. Purposes and legal bases

• Provide the service (performance of a contract): create accounts, generate Superbills, store your records.
• Billing and tax (legal obligation / contract): order processing via Paddle.
• Security and fraud prevention (legitimate interests): detect abuse, protect accounts.
• Product improvement and analytics (legitimate interests): aggregate usage analysis.
• Customer support (legitimate interests / contract): respond to your requests.
• Marketing communications (consent, where required): only with opt-in.

4. Who we share data with

• Paddle.com Market Ltd. — our Merchant of Record, handles payments, subscriptions, tax compliance, invoicing, refunds, and related customer service.
• Hosting and infrastructure providers — cloud hosting, database, file storage, and email delivery subprocessors used to operate the service.
• Professional advisers — legal, accounting, and auditors when required.
• Authorities — where required by applicable law or to protect rights and safety.

We do not sell personal data.

5. International transfers

Where personal data is transferred outside your country of residence (including from the UK/EEA), we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

6. Data retention

We retain account and practice data for the lifetime of your account and for up to 24 months after closure to handle disputes and legal obligations. Billing records are retained for up to 7 years to meet tax and accounting requirements. Support messages are retained for up to 24 months. Backups are rotated and deleted on a rolling 90-day schedule. When data is no longer needed it is deleted or anonymised.

7. Your rights

Depending on your jurisdiction, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time. UK/EEA users may lodge a complaint with their local supervisory authority. To exercise any right, email privacy@holisticbusinesssolutions.com; we will respond within one month.

8. Security

We use appropriate technical and organisational measures including TLS encryption in transit, encryption at rest for stored files, role-based access control, audit logging, and least-privilege access for staff. No system is perfectly secure, but we work to protect your data.

9. Cookies

We use strictly necessary cookies to keep you signed in and to operate the service. Where analytics or marketing cookies are used, we request consent and provide controls to manage your preferences.

10. Children

The service is not directed to children under 16 and we do not knowingly collect their data.

11. Changes

We may update this notice from time to time. Material changes will be notified via the service or by email.

12. Contact

Holistic Business Solutions Inc.
privacy@holisticbusinesssolutions.com