Privacy Policy

1. Scope and responsibility

OrganAlert provides software for healthcare organizations and their authorized users to review donor and recipient information. This policy covers our website, platform, dashboard sharing, and business communications. OrganAlert is the service name; the operating legal entity and mailing address must be confirmed before this review draft is published as the effective policy.

When we handle protected health information (PHI) for a healthcare customer, we act as its HIPAA business associate or subcontractor business associate, as applicable. The customer's instructions, applicable law, and executed Business Associate Agreement (BAA) govern that processing. This policy does not expand our rights to use PHI and is not a healthcare provider's Notice of Privacy Practices.

2. Information we handle

• Clinical information: uploaded donor and recipient documents, extracted clinical fields, source references, notes, decisions, generated summaries, reports, and shared dashboard snapshots.
• Account and business information: name, work email, organization, role, authentication information, and contact or billing details supplied to us.
• Sharing and messaging information: the sharer's identity, share description, recipient mobile number when texting is requested, link expiration and revocation details, acceptance and access events, and messaging-provider status or opt-out records.
• Device and security information: IP addresses, browser information, session events, access logs, and actions within the platform. Some security records use hashed identifiers; hashing does not necessarily make information anonymous.
• Communications: requests for support, privacy, security, or sales assistance. In-product issue reports may include screenshots and report context containing clinical information. Do not put clinical information in ordinary email or text messages.

Information comes from customers, their authorized users, share recipients, our service providers, and interactions with our systems. The sender supplies a recipient's number for a direct dashboard text; that does not by itself establish the recipient's consent.

3. Purposes and limits

We use information to provide contracted document processing, clinical review tools, reports and sharing; authenticate users; manage organizations; respond to requests; administer business relationships; protect the service; investigate incidents; and meet applicable obligations.

We do not sell personal information, use it for cross-context behavioral advertising, or use PHI to train or fine-tune machine-learning models. Processing clinical information with an approved model to provide a requested result is different from training that model. Any reliability testing or improvement involving customer data must be permitted by the customer agreement and applicable law.

4. Disclosures

We disclose information to the responsible customer and its authorized users, to intended dashboard recipients at the customer's direction, and to service providers supporting the contracted service. Providers receiving PHI must be covered by appropriate business associate terms. Providers may not use customer information for their own advertising.

We may disclose non-PHI business information as legally required or necessary to address fraud, security, or legal claims, or in a corporate transaction subject to appropriate protections. These provisions do not authorize a PHI disclosure beyond the BAA and law, or the sale, rental, transfer, or marketing use of SMS consent. See the SMS Privacy Policy for the specific restrictions that apply to mobile information.

5. Dashboard links and text messages

An authorized user can create a link scoped to a dashboard for an intended recipient. The link omits donor and patient names and clinical details, but it is a sensitive access credential: a person who obtains it may be able to open the shared dashboard without signing into an OrganAlert account after the share notice is accepted. Do not forward it.

A share notice acknowledgment is not identity verification, a patient authorization, or consent to receive texts. The sharing organization must confirm the intended recipient, its disclosure authority, and an appropriate information scope, including minimum necessary requirements where applicable. Request immediate revocation through the sharing organization if a link is misdirected or exposed.

With your consent, OrganAlert may send text messages to the mobile number you add in your account: secure links to dashboards a colleague shares with you, and a one-time code to verify your number. An authorized user can also text a shared dashboard link to a US mobile number they enter, including the number of a person without an OrganAlert account; that user is responsible for choosing the recipient. Opening a shared link shows a HIPAA notice before any dashboard. Messages never contain protected health information or patient or donor identifiers. Message frequency varies with clinical activity. Message and data rates may apply. Reply HELP for help or STOP to opt out at any time; you can also turn texts off in your account settings. Consent to receive texts is not a condition of using OrganAlert.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except with our messaging service provider solely to deliver the messages you have requested.

6. Patient and other individual requests

Patients, donors, and recipients seeking access, correction, amendment, restrictions, or an accounting concerning a healthcare record should contact the healthcare organization responsible for that record. We assist that organization as required by the BAA and applicable law; we do not independently decide a patient's treatment-record rights.

You may contact us about access, correction, deletion, or other applicable rights concerning your account or business information. Signed-in users can also download a copy of their own account data at any time from the app. We may verify identity and authority without requesting unnecessary sensitive information. Exceptions, response deadlines, and appeal rights depend on applicable law. We will explain an applicable denial or limitation and any available appeal route. We do not retaliate for exercising privacy rights.

7. Cookies and browser storage

We use cookies and browser storage for authentication, security, session continuity, display preferences, and active-workspace selection. We do not use third-party advertising cookies or cross-site behavioral advertising trackers. Browser controls may limit storage but can affect sign-in or other essential features.

We do not change these necessary operations in response to a browser Do Not Track signal. We do not sell or share information for behavioral advertising. Where applicable law requires recognition of an opt-out preference signal, we will honor it for the activities it covers.

8. Retention and deletion

Retention depends on the record category, the services provided, customer agreements, security needs, and applicable law. Expiration of a dashboard link ends access through that link; it does not necessarily delete the underlying clinical record, snapshot, or audit history.

PHI return or destruction follows the BAA and agreed retention schedule. Where immediate deletion from protected backups is infeasible, the agreement must address continued protection, restricted use, and eventual deletion. Legal holds and mandatory recordkeeping may delay deletion. SMS consent and suppression evidence may need to be retained after opt-out to demonstrate consent and prevent further unwanted messages.

9. Security

The platform includes encryption and access-control mechanisms, tenant-scoped clinical access, and audit logging. Administrative procedures, vendor configurations, and operational checks must support those mechanisms. No storage or transmission method is completely secure. SMS and recipient devices are not a substitute for the platform's security controls.

10. Locations and service providers

Processing locations depend on the customer deployment and the services used. Regional application hosting alone does not establish that all provider logs, support access, backups, or messaging transit stay in that region. Approved locations and any required transfer safeguards must be documented in the customer and provider agreements. Contact us for the deployment-specific subprocessor information.

11. Intended users

The service is intended for healthcare organizations and authorized professional users, not for children to register directly. Customers may submit information about minors only with appropriate authority and under the applicable agreement.

12. Updates and contact

We will publish updates with a revised date and provide additional notice or obtain new consent when required. A policy change does not expand the subject matter of an existing SMS consent.

For privacy, account-data, or messaging questions, contact Viraj at viraj@organalert.com. Do not include PHI, passwords, verification codes, or active dashboard links in email. The sharing healthcare organization is the first contact for clinical-record requests.