export default function Privacy() {
  return (
    <div className="min-h-screen bg-[var(--bg-page,#F4F9F9)]">
      <div className="max-w-[700px] mx-auto px-6 py-12 font-body text-[var(--text-primary,#1C2C2C)]">
        {/* Header */}
        <div className="mb-10">
          <div className="text-[11px] font-semibold tracking-[0.12em] uppercase text-[var(--brand,#147A7A)] mb-3">
            STTIL Solutions LLC
          </div>
          <h1 className="font-heading font-bold text-[28px] text-[#0A3030] mb-2 leading-tight">
            Signal Privacy Policy
          </h1>
          <p className="text-[13px] text-[var(--text-muted,#7A9E9E)]">
            Effective Date: June 7, 2026
          </p>
        </div>

        {/* Who We Are */}
        <section className="mb-8">
          <h2 className="font-heading font-semibold text-[16px] text-[#0A3030] mb-3">Who We Are</h2>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)]">
            STTIL Solutions LLC ("STTIL", "we", "us") operates Signal, a documentation readiness tool for
            DMEPOS suppliers. Signal helps supplier staff identify patients whose documentation may need
            attention before supplies are shipped or claims are submitted. This Privacy Policy describes
            how Signal handles the data uploaded to our platform.
          </p>
        </section>

        {/* What We Process */}
        <section className="mb-8">
          <h2 className="font-heading font-semibold text-[16px] text-[#0A3030] mb-3">What Data Signal Processes</h2>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)] mb-4">
            When your staff uploads a CSV file to Signal, we process:
          </p>
          <ul className="list-disc pl-5 text-[14px] leading-[1.85] text-[var(--text-secondary,#5A7E7E)] space-y-1">
            <li>Your internal patient identifier (MRN or account number) — used as a de-identified tracking key only</li>
            <li>Device type (e.g., Dexcom G7, FreeStyle Libre 3)</li>
            <li>Most recent supply shipment date</li>
            <li>Payer name (Medicare, Medicaid, Commercial)</li>
            <li>Quantity shipped</li>
            <li>Documentation status fields if included in your CSV (SWO status, PA status, PECOS flag)</li>
          </ul>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)] mt-4">
            Signal produces a prioritized documentation worklist as output.
          </p>
        </section>

        {/* What We Do NOT Store */}
        <section className="mb-8">
          <h2 className="font-heading font-semibold text-[16px] text-[#0A3030] mb-3">What Signal Does NOT Store</h2>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)] mb-4">
            Signal is designed to operate without storing protected health information (PHI). We never store:
          </p>
          <ul className="list-disc pl-5 text-[14px] leading-[1.85] text-[var(--text-secondary,#5A7E7E)] space-y-1">
            <li>Patient names</li>
            <li>Social Security numbers</li>
            <li>Dates of birth</li>
            <li>Home addresses</li>
            <li>Phone numbers or email addresses</li>
            <li>Diagnosis codes (ICD codes)</li>
            <li>Clinical notes or records</li>
          </ul>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)] mt-4">
            The connection between a patient identifier and a real patient identity stays with your staff.
            STTIL never holds that crosswalk.
          </p>
        </section>

        {/* How We Store */}
        <section className="mb-8">
          <h2 className="font-heading font-semibold text-[16px] text-[#0A3030] mb-3">How We Store What We Do Collect</h2>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)]">
            Patient identifiers are hashed using SHA-256 before storage — we store a cryptographic fingerprint
            of the identifier, not the identifier itself. The hash cannot be reversed to recover the original
            value. All stored data is associated with your organization's account and protected by row-level
            security (RLS) policies. Your data is not accessible to other Signal customers. All data in
            transit is encrypted via HTTPS. All data at rest is encrypted using AES-256.
          </p>
        </section>

        {/* Patient Outreach */}
        <section className="mb-8">
          <h2 className="font-heading font-semibold text-[16px] text-[#0A3030] mb-3">Patient Outreach</h2>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)]">
            Signal does not contact patients. All outreach and supply decisions remain with your staff.
            Signal surfaces documentation conditions — your team acts on them. All prescriber outreach
            flags go to the prescriber office, never to the patient.
          </p>
        </section>

        {/* Data Retention */}
        <section className="mb-8">
          <h2 className="font-heading font-semibold text-[16px] text-[#0A3030] mb-3">Data Retention and Deletion</h2>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)]">
            Your data is retained for the duration of your subscription plus 90 days. Upon written request,
            all data associated with your account will be deleted within 10 business days, and we will
            confirm deletion in writing. Audit logs are retained for 6 years for compliance purposes.
          </p>
        </section>

        {/* HIPAA */}
        <section className="mb-8">
          <h2 className="font-heading font-semibold text-[16px] text-[#0A3030] mb-3">HIPAA</h2>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)]">
            Signal is designed so that the data it receives is not protected health information
            under the Health Insurance Portability and Accountability Act (HIPAA). The patient
            identifiers your staff upload are your internal account numbers, and the link between
            those identifiers and any real identity stays with your organization at all times.
            Because Signal's architecture is designed to avoid PHI ingestion, a Business Associate
            Agreement (BAA) may not be required for your engagement. We encourage every customer
            to consult their own compliance advisors. If your review concludes that a BAA is
            required for your intended use, contact us before uploading any data and we will
            review the data scope with you.
          </p>
        </section>

        {/* Security Incidents */}
        <section className="mb-8">
          <h2 className="font-heading font-semibold text-[16px] text-[#0A3030] mb-3">Security Incidents</h2>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)]">
            In the event of a security incident affecting your organization's data, STTIL Solutions will
            notify you within 72 hours of discovery. We will provide a description of the incident, the
            data affected, and the steps taken to address it.
          </p>
        </section>

        {/* Contact */}
        <section className="mb-8">
          <h2 className="font-heading font-semibold text-[16px] text-[#0A3030] mb-3">Contact</h2>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)]">
            Questions about this Privacy Policy or your data:
            <br />
            <strong className="text-[var(--text-primary,#1C2C2C)]">STTIL Solutions LLC</strong>
            <br />
            Email:{" "}
            <a
              href="mailto:privacy@sttilsolutions.com"
              className="text-[var(--brand,#147A7A)] underline underline-offset-2"
            >
              privacy@sttilsolutions.com
            </a>
          </p>
        </section>

        {/* Footer */}
        <div className="border-t border-[var(--border-color,#C8D8D8)] pt-6 mt-10">
          <p className="text-[11px] text-[var(--text-muted,#7A9E9E)] leading-[1.6]">
            Signal is operated by STTIL Solutions LLC.{" "}
            <a
              href="https://sttilsolutions.com/signal"
              className="text-[var(--brand,#147A7A)] underline underline-offset-2"
            >
              sttilsolutions.com/signal
            </a>
            {" "}· We may update this policy from time to time. We will notify active customers of material
            changes by email. Continued use of Signal following notice constitutes acceptance.
          </p>
        </div>
      </div>
    </div>
  );
}
