Privacy Policy

Introduction

TEHR LLC ("TEHR," "we," "us") operates the tehr.ai website (the "Site") and provides Telehealth Infrastructure-as-a-Service ("TIaaS") software to healthcare operators, including clinics, telehealth brands, and professional medical entities (collectively, "Operators"). This Privacy Policy describes how TEHR collects, uses, discloses, and safeguards information in connection with the Site and TEHR's business operations.

This Site is a business informational resource intended for prospective Operator clients, partners, vendors, investors, and other institutional users. It is not intended for patients seeking medical care, and no clinical services are offered through this Site.

Scope of this Policy

This Policy applies to information collected through:

• The tehr.ai marketing website;
• Google sign-in to the TEHR pricing calculator at calculator.tehr.ai, as described below;
• Business communications sent to TEHR by email or through demo booking tools;
• Prospective Operator inquiries submitted through the Site;
• Google account and Calendar integration data handled by TEHR when providers authorize the optional integration described below.

This Policy does not apply to:

• Protected Health Information ("PHI") processed through the TEHR platform on behalf of an Operator that is a covered entity under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), which is governed by a separate written Business Associate Agreement between TEHR and that Operator;
• Personal information collected by Operators directly from their patients through Operator-branded portals or applications built on the TEHR platform, which is governed by each Operator's own privacy policy;
• Data collected by third-party services with their own privacy policies, described under Third-Party Services and Subprocessors.

Please review Handling of Protected Health Information for further information regarding TEHR's role and posture with respect to PHI.

Information We Collect

TEHR collects only the information necessary to operate the Site, respond to inquiries, evaluate prospective business relationships, and provide the optional Google sign-in and Google Calendar integrations described below.

Information you provide voluntarily. When you book a demo through our scheduling tool, contact us by email, or otherwise communicate with TEHR, we collect the information you choose to share, which may include your name, business email address, phone number, company name, job title, and the contents of your message or booking notes.

Information collected automatically. When you visit the Site, we collect basic technical information required to operate and secure the Site, including IP address, browser type, device type, referring URL, and pages visited. We use Vercel's built-in privacy-preserving analytics, which does not use cookies and does not collect personal identifiers.

Cookies and similar technologies. The Site uses only strictly necessary cookies required for Site functionality. We do not use advertising cookies or tracking pixels. Third-party services embedded on the Site, such as our demo scheduling tool, may set their own cookies subject to their own privacy policies.

How We Use Information

We use the information we collect for the following purposes:

• To respond to demo requests, inquiries, and business communications;
• To evaluate prospective Operator engagements and business partnerships;
• To operate, maintain, and secure the Site;
• To authenticate calculator users who choose Google sign-in and maintain their account access;
• To provide and maintain the optional Google Calendar integration with the provider’s authorization;
• To communicate with prospective clients about TEHR's platform and services;
• To comply with applicable legal, regulatory, and contractual obligations;
• To detect and prevent fraud, abuse, or unauthorized access.

We do not use information collected through this Site for advertising, retargeting, or sale to third parties.

Legal Bases for Processing

Where applicable law requires a legal basis for processing personal information (including under the European Union General Data Protection Regulation and the California Consumer Privacy Act, as amended), TEHR relies on the following bases:

• Legitimate interests in operating the Site, responding to inquiries, and evaluating prospective business relationships;
• Consent, where you voluntarily provide information through a demo booking or direct communication;
• Legal obligation, where processing is required to comply with applicable laws or regulations;
• Contract performance, where processing is necessary to prepare for or execute a business agreement with you or your organization.

Third-Party Services and Subprocessors

TEHR uses a limited set of trusted third-party services to operate the Site and its business. Each of these services has its own privacy policy, which we recommend you review.

• Vercel Inc. : Site hosting and infrastructure.
• Microsoft Azure : Platform infrastructure and data hosting for the TEHR SaaS platform.
• Google Identity Services: Optional Google sign-in for the TEHR pricing calculator, subject to Google’s Privacy Policy.
• Google Workspace: Business email, productivity tools, and the optional Google Calendar integration described below.
• Calendly : Demo booking and scheduling.
• SendGrid (Twilio) : Transactional email delivery where applicable.

TEHR does not sell, rent, or trade personal information. We share information with the service providers listed above only to the extent necessary for them to perform their contracted services, and each is bound by written agreements restricting their use of information to those services. Where any such provider processes PHI on TEHR's behalf, TEHR maintains an appropriate business associate arrangement with that provider.

We may also disclose information as required by law, in response to lawful requests by public authorities, or to protect TEHR's rights, safety, or property.

Google Sign-In for the TEHR Pricing Calculator

You can choose to sign in to the TEHR pricing calculator using your Google account. TEHR receives a Google-issued identity token, verifies it with Google, and uses your email address, Google account identifier and email-verification status to authenticate you and associate access with your calculator account. Google may also include basic profile details, such as your name and profile image, in its sign-in response.

TEHR stores the account information needed for this sign-in method and records sign-in activity to operate and secure calculator access. After verification, TEHR creates its own application session. TEHR does not receive your Google password. Google sign-in alone does not authorize TEHR to read your email, access Google Drive, or connect your Google Calendar; the optional provider Calendar integration below requires separate authorization.

You can manage your connection to TEHR in your Google Account settings and contact privacy@tehr.ai with access or deletion requests. Removing the Google connection does not by itself delete existing TEHR records or end a TEHR session already issued; see Data Retention for how records are retained. Google’s handling of its sign-in service is described in Google’s Privacy Policy.

Google Calendar Integration

TEHR allows healthcare providers to optionally connect their Google Calendar accounts to synchronize appointment schedules.

With the provider’s authorization, TEHR requests Google Calendar event permissions to create, view, update, and delete calendar events. The integration synchronizes appointments from TEHR to the provider’s selected Google Calendar.

TEHR stores the connected Google account information, authorization credentials, calendar identifiers, and synchronization records necessary to operate this feature. Authentication credentials are protected using the application’s security controls.

Calendar events may include appointment times, provider information, patient initials, and a link to the appointment in TEHR, depending on the configured event template. Event information is transmitted to Google to maintain those events in the selected calendar.

Google Calendar information is used only to provide and maintain the requested integration, not for advertising or the sale of user data.

Providers can disconnect Google Calendar through TEHR or revoke access through their Google Account settings. Disconnecting stops future authorized synchronization, subject to the application’s documented disconnection and data-retention procedures.

For retention and deletion requests, see Data Retention or contact privacy@tehr.ai. Handling of any protected health information remains subject to the applicable arrangements described under Handling of Protected Health Information.

TEHR’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Data Retention

We retain information covered by this Policy for as long as necessary to fulfill the purposes for which it was collected, and for reasonable periods thereafter for business, legal, and regulatory recordkeeping. Specific retention periods vary by data category. Demo booking records and business inquiries are retained for the duration of any prospective or executed business relationship and for a reasonable period thereafter. Server logs and technical information are retained for a limited period consistent with security and operational needs. Information required to be retained by law is retained for the period required by that law.

You may request deletion of personal information you have provided by contacting privacy@tehr.ai, and we will respond consistent with applicable law.

Handling of Protected Health Information

TEHR is not itself a HIPAA covered entity. In its capacity as a Telehealth Infrastructure-as-a-Service platform, TEHR functions as a business associate to Operators that are covered entities under HIPAA. The handling of any PHI processed by TEHR on an Operator's behalf is governed by a separate written Business Associate Agreement between TEHR and that Operator, and by HIPAA's applicable Privacy, Security, and Breach Notification Rules.

TEHR maintains and continues to develop administrative, physical, and technical safeguards designed to protect PHI processed through the TEHR platform, in coordination with regulatory counsel and consistent with 45 C.F.R. Part 164, Subparts C and E. TEHR's business associate compliance framework includes designated Privacy and Security roles, written policies and procedures, workforce training requirements, risk assessment activities, and breach notification procedures. Further information regarding TEHR's compliance program is available to Operators under their Business Associate Agreements.

Security

TEHR takes reasonable and appropriate administrative, physical, and technical measures to protect information under its control from unauthorized access, use, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, access controls, audit logging, workforce training, and vendor risk management.

No method of transmission over the Internet or method of electronic storage is completely secure. While TEHR strives to protect information consistent with industry standards and applicable law, no absolute guarantee of security is possible.

Your Rights

Depending on your jurisdiction, you may have the following rights with respect to personal information TEHR holds about you:

• The right to access personal information we hold about you;
• The right to request correction of inaccurate personal information;
• The right to request deletion of personal information;
• The right to object to or restrict certain processing;
• The right to data portability, where applicable;
• The right to withdraw consent, where processing is based on consent;
• The right to lodge a complaint with a supervisory authority.

California residents have specific rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including the right to know what personal information is collected, the right to delete personal information, the right to correct inaccurate personal information, and the right to opt out of the sale or sharing of personal information. TEHR does not sell or share personal information within the meaning of the CCPA.

Residents of the European Economic Area, the United Kingdom, or Switzerland have rights under the General Data Protection Regulation (GDPR) and applicable national law.

To exercise any of these rights, please contact privacy@tehr.ai. We will respond consistent with applicable law and may require verification of your identity before fulfilling certain requests.

International Data Transfers

TEHR is a United States company, and its platform infrastructure is hosted primarily on Microsoft Azure data centers in the United States. If you access the Site or engage with TEHR from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those in your jurisdiction. Where required by law, TEHR relies on appropriate transfer mechanisms, including Standard Contractual Clauses, for international transfers of personal data.

Children's Privacy

The Site is not directed to children under the age of 13, and TEHR does not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will delete such information promptly. Parents or guardians who believe their child has provided personal information to TEHR should contact privacy@tehr.ai.

Changes to this Policy

TEHR may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this Policy and, where appropriate, provide additional notice through the Site or by other reasonable means. Your continued use of the Site following the effective date of any updated Policy constitutes your acceptance of that Policy.

Contact

For any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact:

Jurisdictional Statement

TEHR provides Telehealth Infrastructure-as-a-Service to Operators located in the fifty (50) United States, the District of Columbia, and the Commonwealth of Puerto Rico. TEHR does not itself deliver clinical services, dispense medications, or serve patients in any jurisdiction. Clinical services referenced on this Site, if any, are delivered solely by independently owned and operated professional medical entities operating under their own state licensure.