How we handle information at TEHR.

Section 01Introduction

TEHR LLC ("TEHR," "we," "us") operates the tehr.ai website (the "Site") and provides Telehealth Infrastructure-as-a-Service ("TIaaS") software to healthcare operators, including clinics, telehealth brands, and professional medical entities (collectively, "Operators"). This Privacy Policy describes how TEHR collects, uses, discloses, and safeguards information in connection with the Site and TEHR's business operations.

This Site is a business informational resource intended for prospective Operator clients, partners, vendors, investors, and other institutional users. It is not intended for patients seeking medical care, and no clinical services are offered through this Site.

Section 02Scope of this Policy

This Policy applies to information collected through:

• The tehr.ai marketing website;
• Business communications sent to TEHR by email or through demo booking tools;
• Prospective Operator inquiries submitted through the Site.

This Policy does not apply to:

• Protected Health Information ("PHI") processed through the TEHR platform on behalf of an Operator that is a covered entity under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), which is governed by a separate written Business Associate Agreement between TEHR and that Operator;
• Personal information collected by Operators directly from their patients through Operator-branded portals or applications built on the TEHR platform, which is governed by each Operator's own privacy policy;
• Data collected by third-party services with their own privacy policies, described in Section 6.

Please review Section 8 for further information regarding TEHR's role and posture with respect to PHI.

Section 03Information We Collect

TEHR collects only the information necessary to operate the Site, respond to inquiries, and evaluate prospective business relationships.

Information you provide voluntarily. When you book a demo through our scheduling tool, contact us by email, or otherwise communicate with TEHR, we collect the information you choose to share, which may include your name, business email address, phone number, company name, job title, and the contents of your message or booking notes.

Information collected automatically. When you visit the Site, we collect basic technical information required to operate and secure the Site, including IP address, browser type, device type, referring URL, and pages visited. We use Vercel's built-in privacy-preserving analytics, which does not use cookies and does not collect personal identifiers.

Cookies and similar technologies. The Site uses only strictly necessary cookies required for Site functionality. We do not use advertising cookies or tracking pixels. Third-party services embedded on the Site, such as our demo scheduling tool, may set their own cookies subject to their own privacy policies.

Section 04How We Use Information

We use the information we collect for the following purposes:

• To respond to demo requests, inquiries, and business communications;
• To evaluate prospective Operator engagements and business partnerships;
• To operate, maintain, and secure the Site;
• To communicate with prospective clients about TEHR's platform and services;
• To comply with applicable legal, regulatory, and contractual obligations;
• To detect and prevent fraud, abuse, or unauthorized access.

We do not use information collected through this Site for advertising, retargeting, or sale to third parties.

Section 05Legal Bases for Processing

Where applicable law requires a legal basis for processing personal information (including under the European Union General Data Protection Regulation and the California Consumer Privacy Act, as amended), TEHR relies on the following bases:

• Legitimate interests in operating the Site, responding to inquiries, and evaluating prospective business relationships;
• Consent, where you voluntarily provide information through a demo booking or direct communication;
• Legal obligation, where processing is required to comply with applicable laws or regulations;
• Contract performance, where processing is necessary to prepare for or execute a business agreement with you or your organization.

Section 06Third-Party Services and Subprocessors

TEHR uses a limited set of trusted third-party services to operate the Site and its business. Each of these services has its own privacy policy, which we recommend you review.

• Vercel Inc. — Site hosting and infrastructure.
• Microsoft Azure — Platform infrastructure and data hosting for the TEHR SaaS platform.
• Google Workspace — Business email and productivity tools.
• Calendly — Demo booking and scheduling.
• SendGrid (Twilio) — Transactional email delivery where applicable.

TEHR does not sell, rent, or trade personal information. We share information with the service providers listed above only to the extent necessary for them to perform their contracted services, and each is bound by written agreements restricting their use of information to those services. Where any such provider processes PHI on TEHR's behalf, TEHR maintains an appropriate business associate arrangement with that provider.

We may also disclose information as required by law, in response to lawful requests by public authorities, or to protect TEHR's rights, safety, or property.

Section 07Data Retention

We retain information collected through this Site for as long as necessary to fulfill the purposes for which it was collected, and for reasonable periods thereafter for business, legal, and regulatory recordkeeping. Specific retention periods vary by data category. Demo booking records and business inquiries are retained for the duration of any prospective or executed business relationship and for a reasonable period thereafter. Server logs and technical information are retained for a limited period consistent with security and operational needs. Information required to be retained by law is retained for the period required by that law.

You may request deletion of personal information you have provided by contacting privacy@tehr.ai, and we will respond consistent with applicable law.

Section 08Handling of Protected Health Information

TEHR is not itself a HIPAA covered entity. In its capacity as a Telehealth Infrastructure-as-a-Service platform, TEHR functions as a business associate to Operators that are covered entities under HIPAA. The handling of any PHI processed by TEHR on an Operator's behalf is governed by a separate written Business Associate Agreement between TEHR and that Operator, and by HIPAA's applicable Privacy, Security, and Breach Notification Rules.

TEHR maintains and continues to develop administrative, physical, and technical safeguards designed to protect PHI processed through the TEHR platform, in coordination with regulatory counsel and consistent with 45 C.F.R. Part 164, Subparts C and E. TEHR's business associate compliance framework includes designated Privacy and Security roles, written policies and procedures, workforce training requirements, risk assessment activities, and breach notification procedures. Further information regarding TEHR's compliance program is available to Operators under their Business Associate Agreements.

Section 09Security

TEHR takes reasonable and appropriate administrative, physical, and technical measures to protect information under its control from unauthorized access, use, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, access controls, audit logging, workforce training, and vendor risk management.

No method of transmission over the Internet or method of electronic storage is completely secure. While TEHR strives to protect information consistent with industry standards and applicable law, no absolute guarantee of security is possible.

Section 10Your Rights

Depending on your jurisdiction, you may have the following rights with respect to personal information TEHR holds about you:

• The right to access personal information we hold about you;
• The right to request correction of inaccurate personal information;
• The right to request deletion of personal information;
• The right to object to or restrict certain processing;
• The right to data portability, where applicable;
• The right to withdraw consent, where processing is based on consent;
• The right to lodge a complaint with a supervisory authority.

California residents have specific rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including the right to know what personal information is collected, the right to delete personal information, the right to correct inaccurate personal information, and the right to opt out of the sale or sharing of personal information. TEHR does not sell or share personal information within the meaning of the CCPA.

Residents of the European Economic Area, the United Kingdom, or Switzerland have rights under the General Data Protection Regulation (GDPR) and applicable national law.

To exercise any of these rights, please contact privacy@tehr.ai. We will respond consistent with applicable law and may require verification of your identity before fulfilling certain requests.

Section 11International Data Transfers

TEHR is a United States company, and its platform infrastructure is hosted primarily on Microsoft Azure data centers in the United States. If you access the Site or engage with TEHR from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those in your jurisdiction. Where required by law, TEHR relies on appropriate transfer mechanisms, including Standard Contractual Clauses, for international transfers of personal data.

Section 12Children's Privacy

The Site is not directed to children under the age of 13, and TEHR does not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will delete such information promptly. Parents or guardians who believe their child has provided personal information to TEHR should contact privacy@tehr.ai.

Section 13Changes to this Policy

TEHR may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this Policy and, where appropriate, provide additional notice through the Site or by other reasonable means. Your continued use of the Site following the effective date of any updated Policy constitutes your acceptance of that Policy.

Section 14Contact

For any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact:

Section 15Jurisdictional Statement

TEHR provides Telehealth Infrastructure-as-a-Service to Operators located in the fifty (50) United States, the District of Columbia, and the Commonwealth of Puerto Rico. TEHR does not itself deliver clinical services, dispense medications, or serve patients in any jurisdiction. Clinical services referenced on this Site, if any, are delivered solely by independently owned and operated professional medical entities operating under their own state licensure.