Privacy Policy

1. Information We Collect

Personal Information

• Name, email, phone number, address
• Date of birth

Health Information (PHI)

• Conditions, diagnoses, treatment information
• Session notes and care plans
• Appointment history
• Assessments and intake forms

Account Information

• Login credentials
• Preferences

Technical Data

• Device identifiers
• IP address, browser type
• Cookies, analytics, and activity logs

Communications

• Emails sent or synced through our platform
• SMS messages (for users who opt in separately)
• Chat logs and support messages

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Services
• Support care coordination
• Schedule appointments and deliver reminders
• Facilitate secure messaging
• Document care in a HIPAA-compliant manner
• Meet regulatory, security, and compliance requirements

We do not use your information, including SMS or email data, for marketing.

3. SMS/Text Messaging Program (TCPA & CTIA Compliance)

3.1 Optional SMS Consent

Receiving SMS messages is 100% optional and requires a separate, explicit opt-in. You may use all Services without opting into SMS.

3.2 Program Name & Message Types

The Elera Health SMS Alerts program sends non-marketing, care coordination messages only. If you opt in, text messages may include:

• Appointment reminders
• Scheduling updates and confirmations
• Intake form links
• Care coordination messages

We do not send promotional or marketing SMS messages.

3.3 Message Frequency

Message frequency varies.

3.4 Costs

Message and data rates may apply.

3.5 Opt-Out

Reply STOP to cancel at any time. After opting out, you will receive one final confirmation message and no further messages will be sent.

3.6 Help & Customer Care

Reply HELP for help. For additional support, contact us at support@elera.health.

SMS terms are governed by our Terms of Service (https://getelera.ai/terms).

3.7 Compliance Logging

We store the date, time, IP address, and consent language for regulatory compliance with TCPA, CTIA, and carrier rules.

4. Google OAuth Data (Required for Verification)

If you connect a Google account, we access limited data to provide automated features.

gmail.readonly

Used only to read messages relevant to appointments, intake forms, or care workflows.

We do not read unrelated emails.

gmail.send

Used only to send non-marketing care-related emails on your behalf.

calendar

Used to view and update appointment events.

Google API Limited Use Compliance

Our use and transfer of Google user data complies with the Google API Services User Data Policy, including:

• No selling or sharing of Google data
• No advertising
• No human access except for security or compliance
• Only minimum necessary data is stored
• All data encrypted in transit and at rest

You can revoke access anytime:

https://myaccount.google.com/permissions

5. Data Security

We use administrative, physical, and technical safeguards including:

• HIPAA-compliant infrastructure
• Encryption in transit and at rest
• Access controls and audit logging
• Vendor security assessments

6. How We Share Information

We share information only with:

• Your provider(s) and care team
• HIPAA-compliant service providers (e.g., AWS, Twilio)
• Google (for OAuth features you personally authorize)
• Legal authorities where required

We do not sell or rent personal information.

All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, excluding aggregators and providers of the Text Message services.

7. Your Rights

Depending on your location and applicable laws, you may:

• Access, update, or correct your information
• Request deletion where permitted
• Obtain a copy of your health records
• Withdraw SMS or email consent
• Revoke OAuth permissions
• File a privacy complaint

Requests: support@elera.health

8. Children’s Privacy (COPPA Compliance)

Elera Health supports care for children under 13 only with verified parental or guardian consent.

Children cannot create accounts.

Guardians may access, update, or delete their child’s information where allowed by law.

9. Cookies & Tracking

We use cookies for:

• Authentication
• Session management
• Analytics and performance

You may disable cookies, but some features may not function properly.

10. Data Retention

We retain PHI and other data only as long as required by:

• HIPAA
• State medical record retention laws
• Business and compliance needs

11. Changes to This Policy

We may update this Privacy Policy. Updates will be posted with a revised effective date. Continued use of the Services constitutes acceptance of the updated policy.

12. Contact Us

© 2025 Elera Health. All rights reserved.