Source: https://vocarihealth.co/privacy # Privacy Policy This Privacy Policy explains how Vocari collects, uses, discloses, and protects personal information when we act for our own business purposes. Effective date September 1, 2026 Document version Counsel review draft 1.1 Applies to Website visitors, prospects, customers, workspace users, and business contacts In this document View document contents Vocari Health, Inc. ("Vocari," "we," "us," or "our") provides patient-access software and related services to healthcare organizations. This Privacy Policy describes our practices for personal information collected through our websites, business communications, customer account administration, and other interactions where Vocari determines how and why the information is processed. ## 1\. Scope and applicability This Privacy Policy applies to vocarihealth.co, the Vocari Trust Center, customer account registration and administration, sales and pilot discussions, events, support communications, and other services that link to this Policy (collectively, the "Services"). This Policy does not govern patient or other Customer Data that Vocari processes solely on behalf of a healthcare organization. That processing is controlled by the healthcare organization, governed by our contract with it, and described further in the [Patient Privacy Policy](https://vocarihealth.co/patient-privacy) . The healthcare organization's own Notice of Privacy Practices or privacy policy also applies. This Policy does not govern third-party websites, products, or services that Vocari does not control. ## 2\. Our privacy roles ### When Vocari determines the purpose of processing Vocari acts for its own business purposes when it operates the public website, manages business contacts, administers user accounts, protects the Services, communicates about contracts or pilots, and performs ordinary corporate operations. ### When Vocari acts for a healthcare customer Vocari acts as a service provider or processor when it handles Customer Data under a healthcare customer's instructions. If that Customer Data is Protected Health Information ("PHI"), Vocari may act as a Business Associate under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA"). The applicable services agreement and Business Associate Agreement ("BAA") govern that processing. ## 3\. Information we collect The information we collect depends on how you interact with Vocari. It may include: - **Identifiers and contact information,** such as your name, business email address, telephone number, mailing address, organization, job title, and professional role. - **Account and authentication information,** such as your user identifier, workspace membership, assigned role, session information, invitation history, password-recovery events, and security activity. We do not store your plaintext password. - **Commercial and relationship information,** such as requested products, pilot scope, practice size, implementation requirements, billing contact, contract status, and support history. - **Professional information,** such as your employer, department, specialty, practice location, and other information relevant to evaluating or operating the Services. - **Communications,** including information you provide in contact forms, email, meetings, support requests, surveys, and feedback. - **Device, network, and usage information,** such as IP address, browser type, device type, operating system, timestamps, referring pages, requested URLs, and interactions needed to operate and secure the Services. - **Security and diagnostic information,** such as login attempts, access decisions, audit events, error details, and information used to prevent abuse, investigate incidents, and maintain reliability. - **Payment and transaction information,** if paid services are enabled. Payment-card details may be collected directly by a payment processor rather than stored by Vocari. Please do not submit patient information through a public contact, marketing, or general support form. Patient information should be provided only through an approved customer workflow. ## 4\. Sources of information We may collect personal information: - directly from you when you submit a form, create or accept an account, communicate with us, attend a meeting, request support, or provide feedback; - from your organization when it identifies you as an authorized contact or workspace user; - automatically from your browser, device, session, and interaction with the Services; - from vendors that support identity, communications, security, infrastructure, billing, and business operations; and - from public professional sources, referrals, event organizers, and business partners when evaluating a legitimate business relationship. ## 5\. How we use information Vocari may use personal information to: - provide, maintain, configure, support, and improve the Services; - create accounts, authenticate users, enforce permissions, and administer customer workspaces; - respond to inquiries, provide demonstrations, evaluate pilots, and manage customer relationships; - send transactional, security, administrative, contractual, and support communications; - send marketing communications where permitted, subject to your ability to opt out; - monitor availability, diagnose failures, prevent fraud and abuse, and protect the confidentiality, integrity, and availability of the Services; - conduct internal analysis, quality assurance, product planning, and research using information appropriate for those purposes; - enforce our agreements, establish or defend legal claims, comply with law, and respond to lawful process; and - carry out another purpose disclosed to you at collection or performed with your direction or consent. Vocari does not sell personal information for money. Vocari does not use patient interaction data for targeted advertising or to train Vocari-owned generalized artificial intelligence models. ## 6\. How we disclose information We may disclose personal information to the following recipients for the purposes described in this Policy: - **Service providers and subprocessors.** Vendors may support cloud infrastructure, database hosting, authentication, communications, security, healthcare transactions, support, billing, and professional services. They may process information only for the contracted purpose and subject to applicable confidentiality and data-protection obligations. - **Your organization.** If your account is associated with a customer, authorized administrators may manage your account, role, workspace access, and activity within that organization's workspace. - **Professional advisers.** Lawyers, auditors, accountants, insurers, and other advisers may receive information when reasonably necessary to provide their services. - **Authorities and protected parties.** We may disclose information when required by law or when reasonably necessary to respond to lawful process, investigate unlawful activity, enforce agreements, protect rights or safety, or address a security incident. - **Transaction participants.** Information may be disclosed in connection with due diligence, financing, reorganization, merger, acquisition, bankruptcy, or sale of all or part of our business, subject to appropriate confidentiality protections. - **Recipients you direct.** We may disclose information when you request it, consent to it, or intentionally use a feature that requires the disclosure. PHI and other Customer Data are disclosed only as permitted by the applicable customer agreement, BAA, customer instruction, and law. ## 7\. Cookies and similar technologies The Services may use session cookies, local storage, and similar technologies that are necessary to authenticate users, remember interface settings, prevent abuse, maintain security, and operate requested features. These technologies may collect device, network, and usage information described above. Vocari does not currently use third-party advertising cookies to build profiles for cross-context behavioral advertising. If our practices materially change, we will update this Policy and provide any legally required notice or choice mechanism. You may configure your browser to limit cookies, although necessary features may not function correctly when required storage is blocked. ## 8\. U.S. state privacy notice Some U.S. state privacy laws require disclosures about categories of personal information collected and disclosed during the preceding twelve months. Depending on your interaction with Vocari, the relevant categories may include: | Category | Examples | Typical recipients | | --- | --- | --- | | Identifiers | Name, email, phone number, IP address, account identifier | Infrastructure, identity, communications, security, and customer administrators | | Customer-record information | Organization, role, mailing address, billing contact | Business operations, billing, support, and professional advisers | | Commercial information | Requested services, pilot scope, transaction and support history | Customer relationship, billing, support, and professional advisers | | Internet or network activity | Browser, device, pages viewed, timestamps, security events | Hosting, security, diagnostics, and operational providers | | Professional information | Employer, title, specialty, practice affiliation | Customer relationship, support, and authorized business partners | | Inferences | Likely product interest or implementation needs derived from business interactions | Vocari business personnel and contracted business systems | | Sensitive information | Account credentials and security information | Identity and security providers solely for permitted operational purposes | Vocari does not knowingly sell these categories for monetary consideration. We do not use sensitive personal information to infer characteristics about individuals. Information governed by HIPAA or other healthcare privacy laws may be exempt from some state consumer privacy laws. ## 9\. Privacy rights and choices Subject to applicable law, you may have the right to: - confirm whether Vocari processes your personal information and obtain access to it; - request correction of inaccurate personal information; - request deletion of personal information; - receive a portable copy of personal information you provided; - opt out of targeted advertising, sale, or qualifying sharing of personal information; - limit certain uses of sensitive personal information; - opt out of qualifying automated decision-making or profiling; and - appeal a decision concerning a privacy request. These rights are not absolute. We may retain or decline to disclose information where an exemption applies, including for security, fraud prevention, legal obligations, privileged material, and information processed solely for a customer. We will not discriminate against you for exercising an applicable right. ### Submitting and verifying a request Submit a request to info@vocarihealth.co or through our [contact page](https://vocarihealth.co/contact) . Describe the right you wish to exercise and the relationship through which Vocari may know you. We may request information reasonably necessary to verify your identity and authority. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and direct confirmation from you. We will respond within the period required by applicable law. If additional time is permitted and reasonably necessary, we will tell you why. If we deny an appealable request, our response will explain how to appeal. ### Communications choices You may unsubscribe from promotional email using the link in the message or by contacting us. We may continue to send security, account, contractual, and other non-promotional communications. Vocari does not share mobile opt-in or consent information with third parties for their own marketing. ## 10\. Customer Data and Protected Health Information Customer Data is controlled by the healthcare organization that submitted it or directed Vocari to collect it. Vocari processes Customer Data to provide, secure, and support the contracted Services and to follow documented customer instructions. If you are a patient or caregiver seeking access to or correction of a healthcare record, contact the healthcare organization first. Vocari will assist that organization as required by contract and law. When Vocari creates, receives, maintains, or transmits PHI for a covered entity or another business associate, our processing is subject to the applicable BAA and relevant provisions of HIPAA. The [Patient Privacy Policy](https://vocarihealth.co/patient-privacy) explains patient-facing processing in more detail. ## 11\. Retention We retain personal information for as long as reasonably necessary for the purpose for which it was collected, including to provide the Services, maintain account and security records, comply with customer instructions, satisfy legal and accounting obligations, resolve disputes, and enforce agreements. Relevant factors include the nature and sensitivity of the information, the potential risk from continued retention, applicable contract terms, and legal requirements. When information is no longer required, we delete, de-identify, or isolate it from further use, subject to technical limitations and lawful retention duties. Customer Data retention and deletion are governed by the customer agreement, BAA, and documented operating policy. Backup copies may remain until they are overwritten through the applicable backup lifecycle and remain protected while retained. ## 12\. Security Vocari uses administrative, physical, and technical safeguards designed to protect personal information according to its sensitivity. Current application safeguards include individual password-protected accounts, role and workspace authorization, encrypted communications, server-side protection of provider credentials, authenticated integrations, audit records for sensitive-data access and selected administration events, restricted caching of protected responses, and controls intended to prevent duplicate or unauthorized workflow actions. No method of electronic transmission or storage can be guaranteed to be completely secure. Please protect your credentials and verification codes and report suspected unauthorized access to info@vocarihealth.co . ## 13\. International processing Vocari is intended to provide Services to organizations in the United States. Vocari personnel and service providers may process information from the United States and other jurisdictions where they operate. Those jurisdictions may have different privacy laws than the location where information was collected. Where required, Vocari uses contractual, access, and operational safeguards intended to support lawful processing and customer requirements. ## 14\. Children Vocari's public websites, business communications, and customer administration tools are intended for adults and organizations. We do not knowingly collect personal information directly from children under thirteen through those Services. If you believe a child submitted information directly to Vocari without appropriate authorization, contact us so we can review the request. Healthcare customers may use configured patient-access workflows for pediatric care. In that context, the healthcare customer determines the lawful basis, notice, consent, and involvement of a parent or personal representative, and Vocari processes the information on the customer's behalf. ## 15\. Changes and contact We may update this Privacy Policy to reflect changes to the Services, our practices, or legal requirements. We will post the revised version with a new effective date and provide additional notice when required by law. Questions, complaints, and privacy requests may be sent to info@vocarihealth.co . Questions concerning a patient's record should ordinarily be directed to the applicable healthcare organization.