Privacy Policy

Information you provide to us.

Personal information you may provide to us through the Service or otherwise includes:

• Contact data, such as your first and last name, email address, company name, and phone number.
• Demographic data, such as your country of residence.
• Profile data, such as the username and password that you may set to establish an online account on the Service.
• Topical interests data, such as health-related procedures in which you may be interested in and locations of interest.
• Communications data based on our exchanges with you, including when you contact us through the Service, social media, or otherwise.
• Marketing data, such as your preferences for receiving our marketing communications and details about your engagement with them.
• Professional data, such as name, professional title and employer name, national provider identification number (NPI) or similar, work contact information, signature, CV information, professional licensure information, tax number, financial information, travel information, picture/video/audio material, and education and professional experience.
• Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Unless we specifically direct you otherwise, we ask that you not provide us with any health-related information (including any information regarding your past, present or future physical or mental health status) through our digital or online properties.

Third-party sources.

We may combine personal information we receive from you with personal information falling within one of the categories identified above that we obtain from other sources, such as:

• Public sources, such as government agencies, public records, social media platforms, and other publicly available sources.
• Data providers, such as information services and data licensors
• Partners, such marketing partners and event co-sponsors.
• Enterprise customers, such as healthcare providers.
• Service providers that provide services on our behalf or help us operate the Service or our business.
• Third-party services, such as social media services, that you use to log into, or otherwise link to, your Service account. This data may include your username, profile picture and other information associated with your account on that third-party service that is made available to us based on your account settings on that service.

Automatic data collection.

We, our service providers, and our business partners may automatically log information about you, your computer or mobile device, and your interaction over time with the Service, our communications and other online services, such as:

• Device data, such as your computer or mobile device's operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier, radio/network information (e.g., Wi-Fi, LTE, 3G), and general location information such as city, state or geographic area.
• Online activity data, such as pages or screens you viewed, how long you spent on a page or screen, the website you visited before browsing to the Service, navigation paths between pages or screens, information about your activity on a page or screen, access times and duration of access, and whether you have opened our emails or clicked links within them.
• Communication interaction data such as your interactions with our email, text or other communications (e.g., whether you open and/or forward emails) – we may do this through use of pixel tags (which are also known as clear GIFs), which may be embedded invisibly in our emails.

For more information concerning our automatic collection of data, please see the Tracking & other technologies section below.

Cookies and similar technologies.

Some of the automatic collection described above is facilitated by the following technologies:

• Cookies, which are small text files that websites store on user devices and that allow web servers to record users' web browsing activities and remember their submissions, preferences, and login status as they navigate a site. Cookies used on our sites include both "session cookies" that are deleted when a session ends, "persistent cookies" that remain longer, "first party" cookies that we place and "third party" cookies that our third-party business partners and service providers place.
• Local storage technologies, like HTML5, that provide cookie-equivalent functionality but can store larger amounts of data on your device outside of your browser in connection with specific applications.
• Web beacons, also known as pixel tags or clear GIFs, which are used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked.
• Session-replay technologies, such as those provided by PostHog that employ software code to record users' interactions with the Services in a manner that allows us to watch video replays of those user sessions. The replays include users' clicks, mobile app touches, mouse movements, scrolls and keystrokes/key touches during those sessions. These replays help us diagnose usability problems and identify areas for improvement. You can learn more about PostHog at www.posthog.com.

For information concerning your choices with respect to the use of tracking technologies, see the Your choices section, below.

Service delivery and operations.

We may use your personal information to:

• provide the Service and operate our business;
• connect you with healthcare providers;
• enable security features of the Service;
• establish and maintain your user profile on the Service;
• communicate with you about the Service, including by sending Service-related announcements, updates, security alerts, and support and administrative messages; and
• provide support for the Service, and respond to your requests, questions and feedback.

Service personalization

which may include using your personal information to:

• understand your needs and interests;
• personalize your experience with the Service and our Service-related communications; and
• remember your selections and preferences as you navigate webpages.

Service improvement and analytics.

We may use your personal information to analyze your usage of the Service, improve the Service, improve the rest of our business, help us understand user activity on the Service, including which pages are most and least visited and how visitors move around the Service, as well as user interactions with our emails, and to develop new products and services.

Marketing and advertising.

We, our service providers and our third-party advertising partners may collect and use your personal information for marketing and advertising purposes:

• Direct marketing. We may send you direct marketing communications and may personalize these messages based on your needs and interests. You may opt-out of our marketing communications as described in the Opt-out of communications section below.
• Interest-based advertising. We and our third-party advertising partners may use cookies and similar technologies to collect information about your interaction (including the data described in the Tracking technologies section above) with the Service, our communications and other online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. You can learn more about your choices for limiting interest-based advertising in the Your choices section.

Compliance and protection.

We may use your personal information to:

• comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas, investigations or requests from government authorities;
• protect our, your or others' rights, privacy, safety or property (including by making and defending legal claims);
• audit our internal processes for compliance with legal and contractual requirements or our internal policies;
• enforce the terms and conditions that govern the Service; and
• prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

Data sharing in the context of corporate events

we may share certain personal information in the context of actual or prospective corporate events – for more information, see How we share your personal information, below.

To create aggregated, de-identified and/or anonymized data.

We may create aggregated, de-identified and/or anonymized data from your personal information and other individuals whose personal information we collect. We make personal information into de-identified and/or anonymized data by removing information that makes the data identifiable to you. We may use this aggregated, de-identified and/or anonymized data and share it with third parties for our lawful business purposes, including to analyze and improve the Service and promote our business.

Cookies and tracking technologies.

In addition to the other uses included in this section, we may use the Cookies and similar technologies described above for the following purposes:

• Technical operation. To allow the technical operation of the Service, such as by remembering your selections and preferences as you navigate the site, and whether you are logged in when you visit password protected areas of the Service.
• Functionality. To enhance the performance and functionality of our services.
• Advertising. To help our third-party advertising partners collect information about how you use the Service and other online services over time, which they use to show you ads on other online services they believe will interest you and measure how the ads perform.
• Analytics. To help us understand user activity on the Service, including which pages are most and least visited and how visitors move around the Service, as well as user interactions with our emails.

Further uses

in some cases, we may use your personal information for further uses, in which case we will ask for your consent to use of your personal information for those further purposes if they are not compatible with the initial purpose for which information was collected.

Messages we send.

• To patients, on behalf of healthcare providers. Replies to inquiries you send to a provider, appointment scheduling, confirmations and reminders, treatment quotes, payment-related notices and follow-ups about your care. These messages are sent from a phone number assigned to that provider.
• To healthcare providers and their staff. Account notifications, alerts about new patient inquiries and requests that need the provider's response.
• Verification codes. One-time codes used to verify your phone number or sign in.

Consent, frequency and charges.

You consent to receive text messages when you provide your mobile number and opt in, for example by checking a consent box on a form, or when you text a provider's HEVA number first. Consent to receive text messages is not a condition of any purchase. Message frequency varies based on your interactions. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

Opting out and help.

Reply STOP to any message to stop receiving text messages from that number. You will receive one final message confirming your opt-out, and no further messages will be sent unless you opt in again (for example, by replying START). Reply HELP for help, or contact us at contact@heva.co.

How we handle your mobile information.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except with the aggregators and providers of text message services that deliver our messages. All other categories of sharing described in this Privacy Policy exclude text messaging originator opt-in data and consent.

Data we access.

With your authorization, HEVA requests the following access to the connected mailbox:

• Read email messages and settings (gmail.readonly), to receive incoming messages, including the sender, recipients, subject, message body, attachments and threading headers, and to show them as conversations in HEVA.
• Send email on your behalf (gmail.send), to send replies that you or your staff write in HEVA, or that HEVA's assistant drafts or sends under the settings you control, from your own mailbox so they stay in the same email thread.
• Basic account information, such as your email address, to identify the connected mailbox.

How we use Google user data.

We use Google user data only to provide and improve the user-facing features of the email integration you enabled: displaying patient emails in your HEVA inbox, linking them to the right patient conversation, generating suggested or automatic replies for your practice, and sending the replies you approve or configure. We do not use Google user data for advertising, to build user profiles for advertising, or for credit or lending decisions, and we do not sell it.

Artificial intelligence.

To generate replies for your practice, the content of relevant messages is processed by artificial intelligence service providers acting on our behalf, solely to produce responses for you. HEVA does not use Google user data to develop, improve or train generalized or non-personalized artificial intelligence or machine learning models, and does not allow its service providers to do so.

Sharing.

We do not transfer Google user data to third parties except as necessary to provide or improve the features described above (for example, to hosting and artificial intelligence service providers bound by confidentiality and data protection obligations), to comply with applicable law, for security purposes such as investigating abuse, or as part of a merger, acquisition or sale of assets with notice to you. HEVA personnel do not read Google user data unless you give us permission for a specific message (for example, for support), it is necessary for security purposes or to comply with applicable law, or the data is aggregated and anonymized for internal operations.

Storage, security and deletion.

Access and refresh tokens are encrypted at rest, and messages are stored as part of your practice's conversation history. You can disconnect your mailbox at any time from your HEVA settings or by revoking HEVA's access at https://myaccount.google.com/permissions. When you disconnect, HEVA stops accessing your mailbox. To request deletion of Google user data HEVA has stored, contact us at contact@heva.co.

Limited Use.

HEVA's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Access or update your information.

If you have registered for an account with us through the Service, you may review and update certain account information by logging into the account.

Opt-out of communications.

You may opt-out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email, or by contacting us. Please note that if you choose to opt-out of marketing-related emails, you may continue to receive service-related and other non-marketing emails. You may opt-out of text messages at any time by replying STOP, as described in the Text messaging (SMS) section above.

Cookies.

Most browsers let you remove or reject cookies. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. Please note that if you set your browser to disable cookies, the Service may not work properly. For more information about cookies, including how to see what cookies have been set on your browser and how to manage and delete them, visit www.allaboutcookies.org. You can also configure your device to prevent images from loading to prevent web beacons from functioning.

Do Not Track.

Some Internet browsers may be configured to send "Do Not Track" signals to the online services that you visit. We currently do not respond to "Do Not Track" signals. To find out more about "Do Not Track," please visit http://www.allaboutdnt.com.

Blocking images/clear gifs:

Most browsers and devices allow you to configure your device to prevent images from loading. To do this, follow the instructions in your particular browser or device settings.

Advertising choices.

You may be able to limit use of your information for interest-based advertising through the following settings/options/tools:

• Browser settings. Changing your internet web browser settings to block third-party cookies.
• Privacy browsers/plug-ins. Using privacy browsers and/or ad-blocking browser plug-ins that let you block tracking technologies.
• Platform settings. Certain platforms offer opt-out features that let you opt-out of use of your information for interest-based advertising. For example, you may be able to exercise that option for Google and Facebook, respectively, at the following websites:
  • Google: https://adssettings.google.com/
  • Facebook: https://www.facebook.com/about/ads
• Ad industry tools. Opting out of interest-based ads from companies that participate in the following industry opt-out programs:
  • Network Advertising Initiative: http://www.networkadvertising.org/managing/opt_out.asp
  • Digital Advertising Alliance: optout.aboutads.info.
  • AppChoices mobile app, available at https://www.youradchoices.com/appchoices, which will allow you to opt-out of interest-based ads in mobile apps served by participating members of the Digital Advertising Alliance.
• Mobile settings. Using your mobile device settings to limit use of the advertising ID associated with your mobile device for interest-based advertising purposes.

You will need to apply these opt-out settings on each device and browser from which you wish to limit the use of your information for interest-based advertising purposes.

We cannot offer any assurances as to whether the companies we work with participate in the opt-out programs described above.

Declining to provide information.

We need to collect personal information to provide certain services. If you do not provide the information we identify as required or mandatory, we may not be able to provide those services.