Effective Date: 9/15/2025
Last Updated: 9/14/2025

Prorenata, Inc. ("Prorenata," "we," "us," or "our") is committed to protecting the privacy and security of personal information, including Protected Health Information (PHI), in accordance with applicable laws and regulations. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you use our AI-powered healthcare automation platform and services.

IMPORTANT: This Privacy Policy applies to our platform and services. Healthcare organizations using our services remain responsible for their own privacy obligations under HIPAA and other applicable laws.

• Contact information (name, email, phone number, business address)
• Professional credentials and licensing information
• Account authentication information
• Billing and payment information

We may process PHI solely as a Business Associate under HIPAA on behalf of covered entities. This includes:

• Patient identifiers and demographic information
• Medical records and clinical data
• Treatment and diagnosis information
• Healthcare payment and billing information

• Device identifiers and IP addresses
• Browser type and operating system
• Usage patterns and system performance data
• Security logs and access records

• Platform usage analytics
• System performance metrics
• Error logs and debugging information

• Delivering AI automation and workflow services
• Processing healthcare data as directed by covered entities
• Maintaining platform functionality and performance
• Providing customer support and technical assistance

• Account management and billing
• Service improvement and development
• Security monitoring and incident response
• Legal compliance and regulatory reporting

We do NOT use PHI for:

• Marketing purposes
• Research without explicit authorization
• Any purpose not specified in our Business Associate Agreement
• Training AI models (unless specifically de-identified and authorized)

We do not sell, rent, or trade personal information or PHI to third parties.

We may disclose information only in the following circumstances:

• As directed by the covered entity we serve
• To authorized users within your organization
• To service providers under strict confidentiality agreements
• As required by law or valid legal process
• To prevent serious threats to health or safety
• For business transfers (with appropriate protections)

Third-party service providers with access to personal information must:

• Sign confidentiality agreements
• Comply with HIPAA requirements (for PHI)
• Implement appropriate security measures
• Use information only for specified purposes

• End-to-end encryption for data in transit and at rest
• Multi-factor authentication for all user accounts
• Regular security assessments and penetration testing
• Continuous monitoring for security threats
• Automated backup and disaster recovery systems

• Role-based access controls with minimum necessary access
• Regular employee security training
• Incident response and breach notification procedures
• Vendor management and oversight programs
• Regular risk assessments and security audits

• Secure data centers with restricted access
• Environmental controls and monitoring
• Secure workstation and media controls
• Device and media disposal procedures

• PHI: Retained only as long as necessary for service provision or as required by law
• Personal Information: Retained for the duration of the business relationship plus applicable legal requirements
• Technical Data: Retained for operational purposes, typically 12-24 months

Upon termination of services or upon request:

• All PHI is securely deleted or returned as directed
• Personal information is securely deleted according to our retention schedule
• Deletion is performed using industry-standard methods

When we process PHI, individuals may have rights to:

• Access their PHI
• Request amendments to PHI
• Request restrictions on use/disclosure
• Request confidential communications
• File complaints with covered entities or HHS

Depending on applicable law, you may have rights to:

• Access personal information we maintain
• Correct inaccurate information
• Request deletion of personal information
• Object to certain processing activities
• Data portability (where applicable)

If we transfer personal information internationally, we ensure appropriate safeguards through:

• Standard contractual clauses
• Adequacy decisions
• Binding corporate rules
• Other legally recognized transfer mechanisms

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children under 18 without parental consent.

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have specific rights regarding their personal information. Please contact us for details about exercising these rights.

We comply with applicable state privacy laws, including those in Virginia, Colorado, Connecticut, and other jurisdictions with comprehensive privacy legislation.

We may update this Privacy Policy periodically. We will:

• Notify you of material changes via email or platform notification
• Post the updated policy with the effective date
• Obtain consent for changes that affect PHI processing (where required)

For privacy-related questions, concerns, or requests:

Privacy Officer
Prorenata, Inc.
[Address]
Email: privacy@prorenata.com
Phone: [Phone Number]

Data Protection Officer (if applicable)
Email: dpo@prorenata.com

This Privacy Policy is designed to comply with:

• Health Insurance Portability and Accountability Act (HIPAA)
• California Consumer Privacy Act (CCPA/CPRA)
• General Data Protection Regulation (GDPR) (where applicable)
• Other applicable federal and state privacy laws

When processing PHI, Prorenata acts as a Business Associate and:

• Complies with all applicable HIPAA requirements
• Maintains separate Business Associate Agreements with covered entities
• Implements appropriate safeguards for PHI
• Reports security incidents as required
• Provides access to PHI as directed by covered entities

This Privacy Policy is a legal document. Please consult with qualified legal counsel to ensure it meets your specific regulatory and business requirements before implementation.