Last updated: May 12, 2026
This Privacy Policy describes how Field.is LLC (“Field,” “we,” “us”) collects, uses, and protects information when you use our practice management platform.
This policy applies to three categories of people:
Operators: Professionals who subscribe to Field to manage their practice. You have a direct account and contractual relationship with us.
Operator Clients: End users of an Operator's services who access the Field portal or whose data is processed through Field. You may not have a direct relationship with Field — your relationship is with your Operator.
Visitors: People who visit field.is or run a scan without creating an account.
If you are an Operator's client: Your Operator is the data controller for your information. Field processes your data on your Operator's behalf as a data processor. Questions about how your data is used should be directed to your Operator first.
From Operators:
From Operator activity (on behalf of Operators):
source_bodyassessment_jsonFrom Operator Clients (via the portal):
From Visitors:
?ref= parameter)All data is used exclusively to provide the Field platform services. Specifically:
We do not sell data. We do not use Operator or Client data for advertising, profiling, or any purpose outside of providing the service.
Field uses three classes of AI processing:
Platform AI (Field's key — Anthropic): Site scanning, request parsing, and report draft generation use Field's own Anthropic credentials. This processing is part of the core service and does not require Operator configuration.
Voice transcription (Field's key — OpenAI Whisper): When an Operator records a voice command in the admin surface, the audio is transmitted to OpenAI's Whisper API using Field's credentials to convert speech to text. The transcribed text is then handed to the Operator's configured AI provider (BYOK, below) for intent parsing. Audio is not retained by Field after transcription completes.
Operator AI (BYOK): Email triage, inline assessment, command bar features, and voice-command intent parsing use the Operator's configured AI provider credentials (Bring Your Own Key). The data relationship for these features is between the Operator and their AI provider; Field facilitates the transmission but does not act as an intermediary processor for the API call itself.
In all cases, data transmitted for AI processing passes through Field's servers. Raw email content (source_body) and AI-generated assessments (assessment_json) are stored in Field's database as described in Section 6.
Field shares data with the following third-party services as necessary to provide the platform:
*@in.field.is)Each processor is governed by its own privacy policy and data processing terms. We select processors that maintain appropriate security standards.
We retain data according to the following schedule:
source_body) and AI-generated assessments (assessment_json): The source_body, assessment_json, and inbox body fields are permanently nulled 18 months after the row was received, by an automated monthly process. Other fields on the same row (request title and description, work entries, attribution status, sender email, in-thread conversation messages) are retained as part of the active operational record; on account closure they are subject to the deletion process described belowOperators may request immediate deletion of their data at any time (see Section 7). Billing records subject to tax retention requirements cannot be deleted early. On account closure, all Operator and Operator-Client data not subject to tax retention is permanently deleted within 60 days.
Operators have the right to:
To exercise any of these rights, contact privacy@field.is. Access, deletion, and export are currently handled as manual processes; we will acknowledge requests within 5 business days and respond substantively within 30 days. Operators with elevated compliance timelines should discuss bespoke arrangements with us in advance.
Field holds data about Operator Clients — people who may not have a direct relationship with Field. This data is processed on behalf of the Operator under the data processor relationship described in our Terms of Service. Operator Clients who wish to exercise privacy rights regarding their data should contact their Operator directly. Operators are responsible for responding to their clients' data requests and may request Field's assistance via privacy@field.is to fulfill them.
If an Operator Client believes their data is being processed improperly, they may contact Field directly at privacy@field.is and we will work with the relevant Operator to address the concern.
Field implements industry-standard security measures including:
No system is perfectly secure. If we discover a data breach that affects your information, we will notify affected parties in accordance with applicable law.
Field uses essential cookies for authentication and session management. We do not use tracking cookies, analytics pixels, or third-party advertising trackers. We do not sell or share browsing data with third parties.
Field is not directed at children under 13. We do not knowingly collect information from children. If you believe a child has provided information to us, contact us and we will delete it.
We may update this Privacy Policy from time to time. Material changes will be communicated via email to Operators at least 14 days before taking effect. The “Last updated” date at the top reflects the most recent revision.
For privacy questions or to exercise your data rights:
privacy@field.is
Field.is LLC
[DECISION NEEDED: mailing address]