OrthoDocs Privacy Policy

1. Introduction

This Privacy Policy describes how Acqwired Inc. ("Acqwired," "we," "us," or "our") collects, uses, discloses, and protects information in connection with the OrthoDocs website at getorthodocs.com and the OrthoDocs referral management platform (collectively, the "Services").

OrthoDocs is a product of Acqwired Inc. This policy applies to information we handle as a business in our own right — for example, information about practice staff, website visitors, and prospective customers.

This Privacy Policy is not a HIPAA Notice of Privacy Practices. A Notice of Privacy Practices is issued by the healthcare provider that treats a patient, not by OrthoDocs. Section 3 explains how Protected Health Information is handled.

2. Information We Collect

We collect the following categories of information:

• Account and practice information. Names, work email addresses, work phone numbers, job titles, practice names, and practice addresses supplied when a practice registers for or administers OrthoDocs.
• Contact and demo request information. Information submitted through our contact or demo request forms, and information you send us by email or phone.
• Referral and patient information. Information submitted to OrthoDocs by or on behalf of a healthcare practice for referral coordination, which may include Protected Health Information. See Section 3.
• Communications data. Records of messages we send and receive through the Services, including SMS communications and related consent and opt-out records.
• Technical and usage information. IP address, browser and device type, pages requested, timestamps, referring pages, and similar log data generated when you use the website or the platform.
• Acceptance records. Records of electronic acceptance of our agreements, including the accepting individual's name, title, email address, the document versions accepted, and the date, time, IP address, and user agent of acceptance.

3. Protected Health Information

When Acqwired Inc. processes Protected Health Information on behalf of a healthcare provider, our use and disclosure of that information is governed by HIPAA, our Business Associate Agreement with the healthcare provider, and other applicable law. Patients seeking to exercise rights concerning medical or treatment records should generally contact the healthcare provider responsible for those records.

In that role Acqwired Inc. acts as a Business Associate, and the healthcare provider acts as the Covered Entity. We use and disclose Protected Health Information only as permitted by the applicable Business Associate Agreement, as required to provide the Services, or as required by law. Where this Privacy Policy conflicts with the applicable Business Associate Agreement with respect to Protected Health Information, the Business Associate Agreement controls.

4. How We Use Information

We use information to:

• provide, operate, maintain, and support the Services;
• coordinate referrals, scheduling, appointment reminders, and related patient communication on behalf of a practice;
• authenticate users and administer accounts and permissions;
• secure the Services, including monitoring for, investigating, and responding to suspected security incidents and misuse;
• respond to demo requests, support requests, and other inquiries you send to us;
• improve reliability and performance and develop new features, using information in a manner consistent with our obligations under HIPAA and our Business Associate Agreements; and
• comply with legal, regulatory, contractual, and recordkeeping obligations, and establish, exercise, or defend legal claims.

5. Service Providers

We use service providers to host, operate, secure, and support the Services. Where a service provider creates, receives, maintains, or transmits Protected Health Information on our behalf and is a Business Associate Subcontractor under HIPAA, we enter into appropriate written agreements before permitting that provider to handle Protected Health Information.

Our current service providers are listed on our Subprocessors page.

6. Sale / Advertising / Secondary Use

We do not sell personal information. We do not share Protected Health Information for advertising or marketing purposes. We do not use Protected Health Information for cross-context behavioral advertising or targeted advertising, and we do not permit third-party advertising networks to collect information from the authenticated OrthoDocs application or from referral intake pages.

No mobile information collected through our SMS program is shared with third parties or affiliates for marketing or promotional purposes. See Section 7.

7. SMS Communications

OrthoDocs sends text messages relating to referral coordination, scheduling, appointment reminders, and customer care where the recipient has consented. Consent to receive text messages is collected separately from any other agreement and is never a condition of receiving healthcare services. Message frequency varies. Message and data rates may apply. You can opt out at any time by replying STOP to any message, and reply HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except with vendors, platforms, or carriers that support message delivery and customer care operations.

The OrthoDocs text-messaging program is governed by its own documents:

• SMS Privacy Policy
• SMS Terms & Conditions

8. Cookies and Analytics

Our public marketing website uses only the storage necessary to serve and render the site. We do not run third-party advertising trackers on the public website.

We do not permit third-party advertising or general web analytics scripts to run on authenticated OrthoDocs application pages or on referral intake pages unless the data flow has been specifically evaluated and approved by our privacy and security function. If we introduce analytics on the public marketing website in the future, we will describe that use in this policy.

9. Retention

We retain information for as long as needed to provide the Services, to meet our legal, regulatory, and recordkeeping obligations, and to establish, exercise, or defend legal claims. Protected Health Information is retained, returned, or destroyed in accordance with the applicable Business Associate Agreement and the customer's instructions. Records of contractual acceptance and of SMS consent and opt-out events are retained as evidence of those events and are not overwritten.

10. Security

We maintain administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of the information we hold, including electronic Protected Health Information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Our safeguards are described in more detail on our Security & HIPAA page.

11. Individual and Patient Requests

If you are a patient or a patient's parent or guardian and you want to access, amend, restrict, or ask questions about medical or treatment records, please contact the healthcare practice responsible for those records. That practice is the Covered Entity under HIPAA and directs how we handle the information we process on its behalf.

If you contact us directly with a request concerning Protected Health Information, we will refer the request to the relevant practice unless the applicable Business Associate Agreement directs otherwise.

For information we hold about you in our own right — for example, your details as a practice user or as someone who requested a demo — you may contact us using the details in Section 15.

12. State Privacy Rights

Depending on where you live, you may have rights to request access to, correction of, or deletion of personal information we hold about you, to request a copy of that information in a portable form, and to be free from discrimination for exercising those rights. We do not sell personal information or share it for cross-context behavioral advertising.

Many state privacy laws exclude Protected Health Information handled under HIPAA and information handled by a Business Associate on a Covered Entity's behalf. Where an exclusion applies, we will explain that when we respond. To make a request, contact us using the details in Section 15. We may need to verify your identity before acting on a request.

13. Children's Information

The OrthoDocs website and platform are intended for use by healthcare practices and their staff, not by children. We do not knowingly collect personal information directly from children for our own purposes.

Orthodontic referrals frequently concern minors. Information about a minor patient is submitted by a practice, by a referring provider, or by a parent or guardian, and we process it as a Business Associate on behalf of the treating practice under HIPAA and the applicable Business Associate Agreement.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date and version identifier shown at the top of this page and publish the updated policy here. Material changes will be communicated to customers as required by our agreements or applicable law.

15. Contact Information

For questions about this Privacy Policy, or to reach us about a privacy or HIPAA matter, contact:

Please do not include patient information or other Protected Health Information in an initial email inquiry.