This Privacy Policy explains how Aipaca — an IRB-approved SMS and voice research assistant operated by the University of Oklahoma — collects, uses, and protects patient information. Aipaca is covered under the University of Oklahoma HIPAA-covered entity, and all data handling follows HIPAA and the IRB-approved research protocol.
Information We Collect
Aipaca collects only the information necessary to conduct the IRB-approved lung cancer screening research study, including:
- Mobile phone number (voluntarily provided on the signed IRB consent form).
- SMS message content exchanged with the Aipaca assistant.
- Voice call recordings and transcripts (only when the patient calls the Aipaca line).
- Basic demographic information (age, smoking history) relevant to USPSTF lung cancer screening eligibility, as provided verbally or via SMS during the consultation.
How We Use Your Information
Information collected via Aipaca is used only to:
- Provide the SMS or voice consultation itself.
- Support your primary care clinician's shared decision-making conversation about lung cancer screening.
- Fulfill research analysis and reporting under the IRB-approved protocol.
- Maintain records per IRB and HIPAA record-retention requirements.
Third-Party Service Providers
Aipaca uses HIPAA-eligible cloud infrastructure and AI services, each covered by a signed Business Associate Agreement (BAA):
- Amazon Web Services — cloud hosting, storage, and SMS delivery via AWS End User Messaging.
- OpenAI — the conversational AI engine (under signed BAA).
These providers process protected health information only in accordance with their BAAs with the University of Oklahoma and do not use Aipaca data to train models or for their own purposes.
Sharing With Third Parties
The University of Oklahoma does not sell, rent, or share patient phone numbers, SMS content, voice recordings, or transcripts with any non-affiliated third parties for marketing, advertising, or any other purpose.
Data Retention
Recordings, transcripts, and phone numbers are retained per the University of Oklahoma IRB-approved research protocol and applicable HIPAA record-retention requirements. All data is stored in encrypted, access-controlled storage accessible only to authorized research personnel.
Your Rights
As a patient, you may:
- Request a copy of the information Aipaca holds about you.
- Request correction or deletion of your information (subject to IRB and HIPAA record-retention rules).
- Withdraw from the research study at any time.
- Opt out of SMS at any time by texting STOP. Opting out does not affect your clinical care.
How to Contact Us
For questions about this privacy policy, or to request a copy of, correction to,
or deletion of your data:
Office of Research Services
The University of Oklahoma
Email: ris@ou.edu
Phone: (405) 325-4757