OpenCoreEMR Privacy Policy

1. SCOPE AND WHO WE ARE

OpenCoreEMR Inc. (“OpenCoreEMR,” “we,” “us,” or “our”), a Delaware corporation with offices at 455 Market St., Suite 1940, PMB 629461, San Francisco, CA 94105, provides a cloud-hosted electronic health records and practice management platform (the “Services”) to health care organizations.

This Privacy Policy describes how we handle personal information for which OpenCoreEMR determines the purposes and means of processing. It applies to our website, our marketing and sales activities, and our administration of customer accounts.

IMPORTANT — THIS POLICY DOES NOT GOVERN PATIENT HEALTH RECORDS. Patient information that a health care provider stores in the Services is Protected Health Information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”). We process that information as a Business Associate, on the instructions of the provider, under a Business Associate Agreement. If you are a patient seeking information about how your health records are used, please consult the Notice of Privacy Practices of your health care provider. Section 6 explains this distinction in more detail.

2. INFORMATION WE COLLECT

2.1 Information you provide directly. When you contact us, request a demo, subscribe to communications, or register for the Services, we collect information such as your name, email address, telephone number, job title, organization name, National Provider Identifier, practice specialty, practice location, and any information you choose to include in a message to us. When you register an account, we also collect the information needed to establish and administer that account, including the legal name of the entity you represent and the credentials of authorized users.

2.2 Information collected automatically. When you visit our website or use the Services, we and our service providers automatically collect device and usage information, including IP address, browser type and version, operating system, referring and exit pages, pages viewed, links clicked, dates and times of access, approximate location derived from IP address, and similar diagnostic data. We collect this information through cookies, pixels, tags, software development kits, server logs, and similar technologies. Section 8 describes these technologies and your choices.

2.3 Account and service usage data. We collect operational data about how your organization uses the Services, including feature usage, session activity, performance metrics, error and latency data, storage consumption, integration activity, and telemetry relating to artificial intelligence features such as prompt volume and response times. This data is generated by the operation of the Services and does not identify individual patients.

2.4 Payment and billing information. If your organization purchases paid Services, our payment processor collects payment card and billing information directly. We receive limited transaction information such as the last four digits of a card, billing contact details, and transaction status. If your organization uses our embedded patient payment features, payment card data is collected and processed by our payment processor under its own terms; we do not store full payment card numbers.

2.5 Information from third parties. We may receive information about you from business partners, resellers, data enrichment providers, publicly available sources, and social or professional networking platforms, including business contact information used for marketing and sales.

2.6 Information we do not seek. We do not ask visitors to our website to provide health information about themselves. Please do not submit patient information, PHI, or other sensitive personal information through our website forms or general email addresses.

3. HOW WE USE INFORMATION

We use the information described in Section 2 to:

• provide, operate, maintain, secure, and improve the Services;

• create and administer accounts, verify identity and professional credentials, and provide customer support;

• process transactions and send related information, including confirmations and invoices;

• communicate with you about the Services, including operational notices, security alerts, product updates, and administrative messages;

• send marketing and promotional communications, subject to your choices described in Section 9;

• analyze usage patterns, conduct research and analytics, and develop new products and features;

• create De-Identified Data as described in Section 5;

• display and measure advertising within the Services as described in Section 7;

• detect, investigate, and prevent fraud, abuse, security incidents, and other harmful or unlawful activity;

• comply with legal obligations, respond to lawful requests, establish or exercise legal rights, and defend against claims; and

• carry out any other purpose disclosed to you at the time of collection or to which you consent.

4. LEGAL BASES FOR PROCESSING

Where the General Data Protection Regulation or similar law applies, we rely on the following legal bases: performance of a contract with you or your organization; our legitimate interests in operating, securing, analyzing, and improving our business and the Services, and in marketing to business contacts; compliance with legal obligations; and your consent, where consent is required and has been obtained. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

5. DE-IDENTIFIED DATA

5.1 What we create. We create de-identified data from data in the Services, including clinical, operational, utilization, outcomes, billing, workflow, and performance data, and including transcriptions of clinical encounter recordings where our customers use recording and transcription features. De-identification is performed in accordance with the standard at 45 C.F.R. § 164.514, using expert determination, the safe harbor method, or both. Once data has been de-identified under that standard, it is no longer PHI and no longer identifies any patient, provider, or individual.

5.2 How we use and disclose it. WE USE, DISCLOSE, LICENSE, SELL, AND OTHERWISE COMMERCIALIZE DE-IDENTIFIED DATA. RECIPIENTS MAY INCLUDE ARTIFICIAL INTELLIGENCE COMPANIES AND MODEL DEVELOPERS, WHO MAY USE DE-IDENTIFIED DATA TO TRAIN, FINE-TUNE, AND EVALUATE ARTIFICIAL INTELLIGENCE MODELS. Recipients may also include life sciences and pharmaceutical companies, researchers, academic institutions, public health organizations, technology companies, and other commercial parties. We also use de-identified data ourselves for analytics, benchmarking, research, product development, model training and evaluation, and service improvement. As set out in our Terms of Service, OpenCoreEMR owns the de-identified data it creates.

5.3 Why we do this. Making the Services available at no charge is funded in part by the commercialization of de-identified data. This is a core part of our business model, and we describe it here so that it is plainly disclosed rather than buried in contract terms.

5.4 Our commitments. We will not use or disclose de-identified data in a manner that identifies or could reasonably be used to identify any customer, patient, or individual. We will not attempt to re-identify any individual from de-identified data, and we contractually prohibit recipients of de-identified data from attempting to re-identify any individual. We maintain administrative, technical, and physical safeguards designed to prevent re-identification.

5.5 Categories excluded. We exclude from de-identified data any records that a customer has identified to us as subject to 42 C.F.R. Part 2 (substance use disorder treatment records), Title X family planning records, or another consent regime more restrictive than HIPAA.

5.6 Provider choice. Health care organizations that require terms restricting the creation or commercialization of de-identified data may contact us at legal@opencoreemr.com to discuss a negotiated agreement.

5.7 Recordings and transcriptions. Where a health care provider uses our recording and transcription features, we may transcribe the recording and delete the source audio or video. Audio and video recordings contain voice and facial characteristics that are biometric identifiers and cannot be de-identified while remaining recordings. We do not sell, license, or otherwise commercialize audio or video recordings as de-identified data. We may use and disclose recordings only as permitted by our Business Associate Agreement with the provider, as directed by the provider, or pursuant to a patient authorization as described in Section 5.8.

5.8 Uses based on patient authorization. Separately from de-identified data, we may use and disclose identifiable patient information where the patient has signed an authorization meeting the requirements of 45 C.F.R. § 164.508. Where such a disclosure will result in payment to us, the authorization will say so expressly. Authorizations are voluntary, a provider may not condition treatment on signing one, and a patient may revoke an authorization at any time. Revocation applies going forward; it does not require us to retrieve information already disclosed, or to alter or retrain a model already developed, in reliance on the authorization before revocation.

5.9 Retention for processing. While a provider’s account is active, we retain source data, including recordings and transcriptions, for the period reasonably necessary to perform transcription, de-identification, expert determination, quality assurance, validation, and model evaluation. After an account ends, we retain identifiable data only to finish de-identification processing already underway (no more than ninety days after the account closes or any data export period ends), where a patient authorization remains in effect, or where the law requires it. We then de-identify or delete the identifiable data, subject to medical records retention requirements and our standard backup cycles.

6. PROTECTED HEALTH INFORMATION AND OUR ROLE

6.1 Two different roles. OpenCoreEMR acts in two distinct capacities. As a Business Associate under HIPAA, and as a Processor under data protection laws, we process patient information on behalf of and under the instructions of our health care organization customers, who are the Covered Entities and Controllers of that information. As a Controller, we determine the purposes and means of processing for the information described in Sections 2.1, 2.2, 2.4, and 2.5, which concerns our website visitors, prospects, and customer account contacts rather than patients.

6.2 What governs PHI. Our processing of PHI is governed by the Business Associate Agreement between OpenCoreEMR and the customer, available at https://opencoreemr.com/business-associate-agreement/, together with our Data Processing Addendum at https://opencoreemr.com/dpa/ and applicable law. This Privacy Policy does not modify, limit, or expand those agreements.

6.3 Patients. If you are a patient and wish to exercise rights regarding your health records, including access, amendment, or an accounting of disclosures, please contact your health care provider. HIPAA requires us to direct those requests to the provider, who is responsible for responding. If you contact us directly, we will forward your request to the applicable provider.

7. ADVERTISING

7.1 We display advertising within the Services, including point-of-care advertising from pharmaceutical and life sciences companies and other third parties. Advertising revenue is one of the ways we fund making the Services available at no charge.

7.2 We may use a third-party ad server platform to deliver and measure this advertising. WE DO NOT DISCLOSE PHI TO ADVERTISERS OR AD PLATFORMS, AND WE DO NOT PERMIT ADVERTISERS TO TARGET INDIVIDUAL PATIENTS. Advertising may be contextual or based on aggregate, de-identified, or account-level attributes such as practice specialty, practice size, or the general category of content being viewed.

7.3 We do not use tracking technologies on pages within the Services that display PHI in a manner that would disclose PHI to a third party without a Business Associate Agreement in place with that third party.

8. COOKIES AND SIMILAR TECHNOLOGIES

8.1 We use cookies and similar technologies, including tag management and web analytics services, on our website and within the Services. We use these technologies for the following purposes: strictly necessary functions such as authentication, session management, and security; functional purposes such as remembering preferences; analytics to understand how our website and the Services are used and to improve them; and advertising and measurement as described in Section 7.

8.2 Your choices. Most browsers allow you to refuse or delete cookies through their settings. Where required by applicable law, we present a consent mechanism allowing you to accept or decline non-essential cookies, and you may change your choice at any time through that mechanism. Disabling cookies may affect the functionality of our website and the Services. We respond to Global Privacy Control and similar browser-based opt-out preference signals where required by applicable law.

9. HOW WE DISCLOSE INFORMATION

We disclose personal information in the following circumstances:

• Service providers and subprocessors. We engage vendors to provide hosting, infrastructure, communications, payment processing, analytics, customer support, and similar functions. They may access personal information only as needed to perform services for us and are bound by contractual obligations to protect it. Our current subprocessor list is available at https://opencoreemr.com/subprocessors.

• Affiliates. We may share information with our corporate affiliates for the purposes described in this policy.

• Recipients of de-identified data. As described in Section 5. This data does not identify any individual.

• Advertising partners. As described in Section 7, and never including PHI.

• At your direction. Where you or your organization instructs us to share information, including through integrations you configure.

• Legal and safety. Where we believe disclosure is required by law, legal process, or governmental request, or is necessary to protect the rights, property, or safety of OpenCoreEMR, our customers, or others, or to investigate fraud or security incidents. Where we receive a legal demand for customer data, we will notify the customer unless prohibited by law.

• Business transfers. In connection with any merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business or assets. De-identified data owned by OpenCoreEMR may be transferred as an asset in such a transaction.

WE DO NOT SELL PHI. We do not disclose PHI other than as permitted by the applicable Business Associate Agreement, our Data Processing Addendum, and applicable law.

10. YOUR PRIVACY RIGHTS

10.1 Rights that may apply to you. Depending on where you live and the applicable law, you may have the right to: request access to the personal information we hold about you; request correction of inaccurate information; request deletion; request a portable copy; opt out of the sale or sharing of personal information and of targeted advertising; limit the use of sensitive personal information; object to or restrict certain processing; and not be discriminated against for exercising these rights.

10.2 How to exercise them. Submit a request to privacy@opencoreemr.com or through https://opencoreemr.com/contact/. We will verify your identity before responding and will respond within the timeframe required by applicable law. You may designate an authorized agent to make a request on your behalf, subject to verification.

10.3 Requests concerning patient records. Requests concerning patient health records must be directed to your health care provider, as described in Section 6.3. If you submit such a request to us, we will forward it to the applicable provider rather than acting on it ourselves.

10.4 De-identified data. Because de-identified data does not identify you and cannot reasonably be used to identify you, it is outside the scope of most access, correction, and deletion rights, and we do not attempt to re-identify data in order to respond to a request. This is consistent with applicable law, which excludes de-identified information from the definition of personal information.

10.5 California residents. If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act provides the rights described in Section 10.1. In the preceding twelve months, we have collected the categories of personal information described in Section 2 for the purposes described in Section 3, from the sources described in Section 2, and disclosed them to the categories of recipients described in Section 9. Medical information governed by HIPAA and de-identified information are exempt from the CCPA. To the extent our disclosure of information to advertising partners constitutes “sharing” for cross-context behavioral advertising, you may opt out by contacting us at privacy@opencoreemr.com or by using an opt-out preference signal as described in Section 8.2. We do not knowingly sell or share the personal information of consumers under 16 years of age.

10.6 Appeals. Where applicable law provides a right to appeal a decision on your request, you may appeal by writing to privacy@opencoreemr.com with the subject line “Privacy Request Appeal.”

11. DATA RETENTION

We retain personal information for as long as necessary to fulfill the purposes described in this policy, including to provide the Services, comply with legal, tax, accounting, audit, and regulatory obligations, resolve disputes, and enforce our agreements. Retention of PHI and patient records is governed by the applicable Business Associate Agreement, our Terms of Service, and applicable medical records retention law, which may require retention for extended periods. As described in Section 5.9, we also retain source data for the period necessary to perform transcription, de-identification, and related processing. De-identified data is retained indefinitely. Information in backup and archival systems is deleted in accordance with our standard backup retention cycles.

12. SECURITY

We maintain a written information security program with administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, role-based access controls, logging and monitoring, vulnerability management, and regularly scheduled risk assessments. A description of our technical and organizational measures is set out in our Data Processing Addendum. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your information, we will notify you and any applicable regulator as required by law and by our agreements with our customers.

13. INTERNATIONAL USERS AND DATA TRANSFERS

13.1 OpenCoreEMR is headquartered in the United States and processes and stores information in the United States. If you access the Services from outside the United States, your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

13.2 Where we transfer personal information subject to the GDPR, UK GDPR, or Swiss FADP outside the originating jurisdiction, we rely on the transfer mechanisms set out in Schedule 3 of our Data Processing Addendum, including the European Commission Standard Contractual Clauses and the UK International Data Transfer Addendum.

13.3 Customers accessing the Services from outside the United States are responsible for compliance with the health information privacy, medical records, and data localization laws of their own jurisdictions. De-identification performed under 45 C.F.R. § 164.514 is a standard established under United States law and may not satisfy anonymization requirements under the GDPR or other non-U.S. regimes.

14. CHILDREN

Our website and the Services are intended for use by health care professionals and are not directed to children. We do not knowingly collect personal information directly from children through our website. Patient records maintained in the Services by a health care provider may include information about minors; that information is PHI and is governed as described in Section 6.

15. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. When we do, we will post the updated policy on this page and revise the “Last Updated” date. If we make material changes, we will provide notice by email to account contacts or by notice within the Services before the changes take effect. Your continued use of the Services after the effective date of an updated policy constitutes acceptance of it.

16. CONTACT US

Questions, requests, or complaints regarding this Privacy Policy may be directed to:

OpenCoreEMR Inc., Attention: Privacy

455 Market St., Suite 1940, PMB 629461, San Francisco, CA 94105

privacy@opencoreemr.com

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to lodge a complaint with your local supervisory authority.