Client Portal Privacy Policy

This Privacy Policy outlines how Avara Software LLC ("Avara Software," "we," "us," or "our") collects, utilizes, and shares the Personal Information (defined below) of patients and clients ("Clients," "you," or "your") of our Customers (healthcare and wellness providers, referred to as your "Provider" or our "Customer") when using the Client Portal, including the client web portal, mobile application, and telehealth services (collectively, the "Client Portal" or the "Services").

Please note that some of our other Services may include their own privacy policies. Where such a policy exists, it will govern the use and disclosure of Personal Information for that specific Service rather than this document.

Note to Avara Software Customers and Their Clients

Our handling of Client Personal Information is governed by agreements with our Customers, such as our Terms of Service and HIPAA Business Associate Agreement (collectively referred to as the "Agreement"). In case of any discrepancy between this Privacy Policy and our Agreement with a Customer, the Agreement shall prevail.

Clients should be aware that their Provider is the data controller for their personal data. See the sections titled "California Privacy Statement" and "Additional State Privacy Laws" for more.

If you are a Client of a Customer, Avara Software may retain your Personal Information on that Customer's behalf. Questions regarding how your information is handled should be directed to your Provider or to us by email at richiebailey@avarasoftware.com

Personal Information We Collect

"Personal Information" includes details that identify, relate to, describe, or can reasonably be linked to you or your household. This may include your name, contact details, health or educational information, commercial data, internet activity, and more. We may collect this data directly from you or through your Provider. The data collected depends on your interactions with the Client Portal. Types of data collected include:

Identifiers and contact details: Includes name, email, address, phone number, IP address. Used for enabling communication, access, and document signing.
Billing data: Insurance, invoices, service details, Provider info. Stored for payment processing and Client Portal management.
Audio, electronic, visual data: Images, voice, or similar media used in Telehealth or file uploads.
Internet and network activity: Browsing, device data, and site interaction metrics collected anonymously for analytics.
Profile data and preferences: Inferred traits or usage patterns gathered anonymously to improve services.
Appointment information: Dates, times, and locations of your Provider appointments.
Sensitive data: Includes health status, orientation, IDs, and secure messaging. Stored on behalf of Providers for service delivery and billing, compliant with HIPAA.
Authentication data: Info from linked login services like Google (e.g., email, auth tokens). Used solely for providing services and support, not for advertising. You can disconnect such accounts anytime.

How We Use Personal Information

Beyond the specific uses above, we process your data to:

Maintain and update your Client Profile
Send updates and requested information
Respond to inquiries or support requests
Process billing and verify identity
Improve and monitor the Services
Detect and prevent security threats or fraud
Meet legal or regulatory obligations
Fulfill any purpose for which you've provided consent

Sharing and Disclosure of Personal Information

We may disclose your Personal Information:

To your Provider/our Customer, to deliver the Services
To authorized Service Providers (e.g., hosting, analytics, payments), under agreements restricting their use to only necessary service delivery
To affiliates or legal authorities, as required by law, legal process, or in case of fraud, safety threats, or legal claims
To third parties with your explicit consent
In corporate transactions (e.g., mergers, acquisitions, bankruptcy), as needed

Access and Choice

Profile updates: Most updates must be made via your Provider, though billing info may be editable by you in the Client Portal
Notification preferences: Manage in your Notification Settings section
Deletion requests: Contact your Provider to request deletion of data stored in the Client Portal. Other deletion rights may apply—see the "California Privacy Statement" and "Additional State Privacy Laws"

Note: Services are only available if you are a Client of an Avara Software Customer.

Data Collection Technologies and Cookies

We and our partners may automatically gather information such as:

Log data: IP address, browser info, session time, errors, etc.
Analytics data: Site interaction paths, activity logs, usage trends
Location data: General location inferred via IP

Data is collected through cookies and similar tech (pixels, beacons, embedded scripts). This helps us analyze user behavior and improve the Services.

You may adjust your browser settings to reject or manage cookies. However, disabling cookies may impair functionality.

Our systems do not respond to "Do Not Track" signals.

Retention and Security

We retain your Personal Information as long as it is needed to provide Services, meet legal requirements, or resolve disputes.

We employ standard security practices like SSL encryption during form submissions. However, no system can guarantee absolute security.

California Privacy Statement

California residents have certain rights under the California Shine the Light law, the California Consumer Privacy Act ("CCPA"), and the California Privacy Rights Act ("CPRA"). The CPRA provided amendments and updates to the CCPA.

CCPA and CPRA Disclosures: In general, within the preceding 12 months:

We have collected the categories of Personal Information listed in Section 2 above.
We have collected these categories of Personal Information directly from you, indirectly from your Provider or our Customer, and when you use the Client Portal and our Services, for the purposes described in Section 3 above.
We have disclosed the following categories of Personal Information for business purposes: Billing and transactional information; internet, device, and network activity information; and profile information and inferences.
We have not sold your Personal Information.

CPRA and CCPA Privacy Rights: Certain California residents are entitled to privacy rights under the CPRA and CCPA. Clients who wish to exercise these rights should send an email to richiebailey@avarasoftware.com and also direct their requests to the Customer who controls their Personal Information.

The right to know. You have the right to request to know (i) the specific pieces of Personal Information we have about you; (ii) the categories of Personal Information we have collected about you in the last 12 months; (iii) the categories of sources from which that Personal Information was collected; (iv) the categories of your Personal Information that we sold or disclosed in the last 12 months; (v) the categories of third parties to whom your Personal Information was sold or disclosed in the last 12 months; and (vi) the purpose for collecting and selling your Personal Information.
The right to deletion. You have the right to request that we delete the Personal Information that we, including our third-party Service Providers, have collected or maintain about you. We may deny your request under certain circumstances, such as if we need to comply with our legal obligations or complete a transaction for which your Personal Information was collected. If we deny your request for deletion, we will let you know the reason why.
The right to correct. You have the right to request correction of any inaccurate Personal Information we have about you.
The right to opt-in and opt-out of sharing and selling of your Personal Information. We do not sell your Personal Information. We only share your Personal Information as outlined in this privacy policy to provide our Services to you.
The right to limit use and disclosure of sensitive personal information. You have the right to restrict the ways in which we use and disclose your sensitive personal information. We do not use, share, or disclose your sensitive personal information in any way, except as outlined in this privacy policy for the purposes of providing our Services to you. We do not exchange this information for cross-contextual behavioral advertising nor for any commercial or monetary purposes.
The right to equal service. If you choose to exercise any of these rights, we will not discriminate or retaliate against you in any way. If you exercise certain rights, understand that you may be unable to use or access certain features of our Services.

You may exercise your right to know and your right to deletion twice a year free of charge. Currently, there is no limitation on your right to correct, although this is forthcoming. The remainder of your privacy rights are not subject to limitations. To exercise your privacy rights please contact us at richiebailey@avarasoftware.com.

We will take steps to verify your identity before processing your privacy rights requests. We will not fulfill your request unless you have provided sufficient information for us to verify you are the individual about whom we collected Personal Information. If you have a Client Profile and use our Services, we will use our existing authentication practices to verify your identity. If you do not have a Client Profile, we may request additional information about you to verify your identity. We will only use the Personal Information provided in the verification process to verify your identity or authority to make a request and to track and document request responses, unless you initially provided the information for another purpose.

You may use an authorized agent to submit a privacy rights request. When we verify your agent's request, we may verify both your and your agent's identity and request a signed document from you that authorizes your agent to make the request on your behalf. To protect your Personal Information, we reserve the right to deny a request from an agent that does not submit proof that they have been authorized by you to act on their behalf.

Shine the Light: Our California Clients are also entitled to request and obtain from Avara Software once per calendar year information about any of your Personal Information shared with third parties for their own direct marketing purposes, including the categories of information and the names and addresses of those businesses with which we have shared such information. However, we do not share your information with third parties for their own direct marketing purposes.

Additional State Privacy Laws

Avara Software takes our Customers' and Clients' privacy and data protection very seriously, and we work vigorously to ensure we remain compliant with applicable federal and state privacy laws.

Under the Virginia Consumer Data Protection Act (VCDPA), effective January 1, 2023, Virginia residents have additional privacy rights. Clients who wish to exercise these rights should send an email to richiebailey@avarasoftware.com and also direct their requests to the Customer who controls their Personal Information.

The right to know, access and confirm personal data. You have the right to know whether or not we are processing your personal data and to access such personal data.
The right to deletion. You have the right to request that we delete the Personal Information that we, including our third-party service Providers, have collected or maintain about you. We may deny your request under certain circumstances, such as if we need to comply with our legal obligations or complete a transaction for which your Personal Information was collected. If we deny your request for deletion, we will let you know the reason why.
The right to correct. You have the right to request correction of any inaccurate Personal Information we have about you.
The right to data portability. You have the right to easy and portable access to all pieces of Personal Information that we have collected or maintain about you.
The right to opt-out of the processing of personal data for targeted advertising purposes. We do not use your Personal Information for targeted advertising. We may use your Personal Information, however, to provide updates to you about our product and Services and other necessary communications in the course of providing our services to you and your Provider.
The right to opt-out of the sale of personal data. We do not sell your Personal Information. We only share your Personal Information as outlined in this privacy policy to provide our Services to you.
The right to opt-out of profiling based upon personal data. You have the right to opt-out of any processing of personal data for the purposes of profiling for decisions that produce legal effects or similarly significant effects on you. We do not use your Personal Information for this purpose.
The right to equal service. If you choose to exercise any of these rights, we will not discriminate or retaliate against you in any way. If you exercise certain rights, understand that you may be unable to use or access certain features of our Services.

Per the VCDPA, information provided in response to your requests shall be provided by us, free of charge, up to twice annually per Client. We will update this privacy policy periodically and as necessary to maintain compliance with the evolving privacy landscape.

Additional Information

International users: Our systems operate in the U.S. and your data may be processed there. Laws may differ from your local jurisdiction.
External links: We're not responsible for the privacy policies of third-party sites linked within the Services.
Children: Our Services are not intended for children under 13 unless they are Clients of our Customers. Contact your Provider for their policies on minor Clients.

This Privacy Notice may be updated by us from time to time. Updates to the Privacy Notice are effective immediately when posted. Please review this Privacy Notice regularly for updates. If required by any applicable law, Avara Software will directly contact you to provide you with an updated Privacy Policy.

Contact Us

If you have questions regarding this Privacy Notice, please contact us at: richiebailey@avarasoftware.com

Effective Date: December 1, 2024

Last Updated: April 24, 2025