Signal/signal-ui/src/Privacy.jsx

export default function Privacy() {
  return (
    <div className="min-h-screen bg-[var(--bg-page,#F4F9F9)]">
      <div className="max-w-[700px] mx-auto px-6 py-12 font-body text-[var(--text-primary,#1C2C2C)]">
        {/* Header */}
        <div className="mb-10">
          <div className="text-[11px] font-semibold tracking-[0.12em] uppercase text-[var(--brand,#147A7A)] mb-3">
            STTIL Solutions LLC
          </div>
          <h1 className="font-heading font-bold text-[28px] text-[#0A3030] mb-2 leading-tight">
            Signal Privacy Policy
          </h1>
          <p className="text-[13px] text-[var(--text-muted,#7A9E9E)]">
            Effective Date: June 7, 2026
          </p>
        </div>

        {/* Who We Are */}
        <section className="mb-8">
          <h2 className="font-heading font-semibold text-[16px] text-[#0A3030] mb-3">Who We Are</h2>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)]">
            STTIL Solutions LLC ("STTIL", "we", "us") operates Signal, a documentation readiness tool for
            DMEPOS suppliers. Signal helps supplier staff identify patients whose documentation may need
            attention before supplies are shipped or claims are submitted. This Privacy Policy describes
            how Signal handles the data uploaded to our platform.
          </p>
        </section>

        {/* What We Process */}
        <section className="mb-8">
          <h2 className="font-heading font-semibold text-[16px] text-[#0A3030] mb-3">What Data Signal Processes</h2>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)] mb-4">
            When your staff uploads a CSV file to Signal, we process:
          </p>
          <ul className="list-disc pl-5 text-[14px] leading-[1.85] text-[var(--text-secondary,#5A7E7E)] space-y-1">
            <li>Your internal patient identifier (MRN or account number) — used as a de-identified tracking key only</li>
            <li>Device type (e.g., Dexcom G7, FreeStyle Libre 3)</li>
            <li>Most recent supply shipment date</li>
            <li>Payer name (Medicare, Medicaid, Commercial)</li>
            <li>Quantity shipped</li>
            <li>Documentation status fields if included in your CSV (SWO status, PA status, PECOS flag)</li>
          </ul>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)] mt-4">
            Signal produces a prioritized documentation worklist as output.
          </p>
        </section>

        {/* What We Do NOT Store */}
        <section className="mb-8">
          <h2 className="font-heading font-semibold text-[16px] text-[#0A3030] mb-3">What Signal Does NOT Store</h2>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)] mb-4">
            Signal is designed to operate without storing protected health information (PHI). We never store:
          </p>
          <ul className="list-disc pl-5 text-[14px] leading-[1.85] text-[var(--text-secondary,#5A7E7E)] space-y-1">
            <li>Patient names</li>
            <li>Social Security numbers</li>
            <li>Dates of birth</li>
            <li>Home addresses</li>
            <li>Phone numbers or email addresses</li>
            <li>Diagnosis codes (ICD codes)</li>
            <li>Clinical notes or records</li>
          </ul>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)] mt-4">
            The connection between a patient identifier and a real patient identity stays with your staff.
            STTIL never holds that crosswalk.
          </p>
        </section>

        {/* How We Store */}
        <section className="mb-8">
          <h2 className="font-heading font-semibold text-[16px] text-[#0A3030] mb-3">How We Store What We Do Collect</h2>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)]">
            Patient identifiers are hashed using SHA-256 before storage — we store a cryptographic fingerprint
            of the identifier, not the identifier itself. The hash cannot be reversed to recover the original
            value. All stored data is associated with your organization's account and protected by row-level
            security (RLS) policies. Your data is not accessible to other Signal customers. All data in
            transit is encrypted via HTTPS. All data at rest is encrypted using AES-256.
          </p>
        </section>

        {/* Patient Outreach */}
        <section className="mb-8">
          <h2 className="font-heading font-semibold text-[16px] text-[#0A3030] mb-3">Patient Outreach</h2>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)]">
            Signal does not contact patients. All outreach and supply decisions remain with your staff.
            Signal surfaces documentation conditions — your team acts on them. All prescriber outreach
            flags go to the prescriber office, never to the patient.
          </p>
        </section>

        {/* Data Retention */}
        <section className="mb-8">
          <h2 className="font-heading font-semibold text-[16px] text-[#0A3030] mb-3">Data Retention and Deletion</h2>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)]">
            Your data is retained for the duration of your subscription plus 90 days. Upon written request,
            all data associated with your account will be deleted within 10 business days, and we will
            confirm deletion in writing. Audit logs are retained for 7 years for compliance purposes.
          </p>
        </section>

        {/* HIPAA */}
        <section className="mb-8">
          <h2 className="font-heading font-semibold text-[16px] text-[#0A3030] mb-3">HIPAA</h2>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)]">
            Signal processes de-identified operational data. To the extent that any data processed by Signal
            could be considered protected health information under HIPAA, STTIL Solutions has executed a
            Business Associate Agreement (BAA) with its cloud infrastructure providers and operates
            appropriate administrative, physical, and technical safeguards. If you believe a BAA is required
            for your engagement with Signal, please contact us before uploading any data.
          </p>
        </section>

        {/* Security Incidents */}
        <section className="mb-8">
          <h2 className="font-heading font-semibold text-[16px] text-[#0A3030] mb-3">Security Incidents</h2>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)]">
            In the event of a security incident affecting your organization's data, STTIL Solutions will
            notify you within 72 hours of discovery. We will provide a description of the incident, the
            data affected, and the steps taken to address it.
          </p>
        </section>

        {/* Contact */}
        <section className="mb-8">
          <h2 className="font-heading font-semibold text-[16px] text-[#0A3030] mb-3">Contact</h2>
          <p className="text-[14px] leading-[1.75] text-[var(--text-secondary,#5A7E7E)]">
            Questions about this Privacy Policy or your data:
            <br />
            <strong className="text-[var(--text-primary,#1C2C2C)]">STTIL Solutions LLC</strong>
            <br />
            Email:{" "}
            <a
              href="mailto:kisasttil@gmail.com"
              className="text-[var(--brand,#147A7A)] underline underline-offset-2"
            >
              kisasttil@gmail.com
            </a>
          </p>
        </section>

        {/* Footer */}
        <div className="border-t border-[var(--border-color,#C8D8D8)] pt-6 mt-10">
          <p className="text-[11px] text-[var(--text-muted,#7A9E9E)] leading-[1.6]">
            Signal is operated by STTIL Solutions LLC.{" "}
            <a
              href="https://signal.sttilsolutions.com"
              className="text-[var(--brand,#147A7A)] underline underline-offset-2"
            >
              signal.sttilsolutions.com
            </a>
            {" "}· We may update this policy from time to time. We will notify active customers of material
            changes by email. Continued use of Signal following notice constitutes acceptance.
          </p>
        </div>
      </div>
    </div>
  );
}