Zoren AI
Data Policy
This Data Policy describes the technical and organizational measures Zoren AI uses to classify, store, secure, retain, and dispose of data processed through our Service, including protected health information (“PHI”) processed as a HIPAA business associate. It supplements, and does not replace, our Privacy Policy and any Business Associate Agreement or master services agreement in place with a Customer, which control in the event of any conflict.
1. Purpose & audience
This policy is written for Customer security and compliance reviewers, procurement teams, and auditors who need detail beyond what a consumer-facing privacy policy typically covers. Some figures and lists below are illustrative of our current architecture and must be verified against production configuration before this page is published or shared as part of a security review response.
2. Data classification
| Category | Examples | Handling |
|---|---|---|
| Protected Health Information (PHI) | Patient demographics, insurance details, clinical/prescription data submitted for PA processing | Governed by HIPAA and the applicable Customer BAA; encrypted at rest and in transit; access limited to authorized roles |
| Personally Identifiable Information (PII) — non-PHI | User account name, work email, organization | Governed by this policy and our Privacy Policy |
| Credentials & secrets | Passwords, integration API keys, session tokens | Stored using industry-standard hashing/encryption; never logged or displayed in plaintext |
| De-identified / aggregate data | Usage metrics, aggregated workflow statistics | Used for product analytics and improvement; not re-identifiable without independent access to source data |
3. Storage & encryption
- Data is encrypted in transit using TLS.
- Data at rest is encrypted using our infrastructure providers’ encryption-at-rest capabilities.
- Sensitive fields such as integration credentials are additionally encrypted at the application layer before storage.
- [Placeholder — confirm current encryption algorithms, key management approach, and specific infrastructure providers with engineering before publishing.]
4. Access controls
Access to production systems and Customer Data is limited to authorized personnel on a least-privilege basis, role-based within the Service for Customer end users, and subject to authentication requirements. Administrative access to production infrastructure is logged and periodically reviewed.
5. Multi-tenant isolation
The Service is a multi-tenant platform operating on a shared database with logical, organization-scoped isolation enforced in application logic and access-control checks, so that one Customer organization’s data is not visible to another. Platform-level administrative roles that can span organizations are restricted and audited.
6. Sub-processors & integrations
We use the following categories of sub-processors and third-party integrations to provide the Service. This list reflects our current architecture and must be reviewed, confirmed, and kept current by engineering and legal before being relied upon in a Customer-facing security questionnaire or DPA exhibit.
| Category | Purpose |
|---|---|
| Cloud infrastructure & database hosting | Application hosting and managed database services |
| CoverMyMeds / CMM Automate integration bridge | Prior-authorization portal login, submission, and case-status lookup on Customer’s behalf |
| Salesforce | Customer relationship / case management integration, where enabled by a Customer |
| Fax and e-fax providers | Transmission of prior-authorization documents where required by a payer or pharmacy |
| Voice/telephony providers | Voice-call automation features, where enabled by a Customer |
| Email/SMTP providers | Transactional email and fax-by-email delivery |
7. Retention & deletion
We retain Customer Data, including PHI, for as long as necessary to provide the Service and to satisfy legal, regulatory, and contractual recordkeeping obligations (including HIPAA-related retention requirements set out in the applicable BAA), after which it is deleted or de-identified in accordance with that agreement. [Placeholder — confirm specific retention periods per data category and the operational deletion process with engineering/compliance before publishing.]
8. Audit logging
We maintain audit logs of access to and material changes affecting Customer Data and PHI, including authentication events and administrative actions, to support security monitoring and compliance obligations under HIPAA and applicable Customer agreements.
9. Breach notification
In the event of a security incident involving unauthorized access to, use of, or disclosure of PHI, we will notify affected Customers in accordance with the timeframes and procedures set out in the applicable Business Associate Agreement and as required by the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414) and other applicable law. Notification timing and content requirements are governed by that agreement and by law, not by this webpage.
10. Data subject requests
Because Customers generally control the PHI and other personal information submitted to the Service, requests from patients or other individuals to access, correct, or delete their information should be directed to the relevant Customer (healthcare provider or pharmacy) in the first instance. We will support our Customers in fulfilling such requests as required by the applicable BAA or Customer agreement.
11. Security reporting
If you believe you have discovered a security vulnerability in the Service, please report it to info@zoren.ai. [Placeholder — confirm whether a formal responsible-disclosure/safe-harbor policy should be published alongside this contact, and have it reviewed by counsel before publishing.]
12. Changes to this policy
We may update this Data Policy from time to time to reflect changes in our architecture, sub-processors, or legal obligations. Material changes will be reflected in the “Last updated” date above.
13. Contact us
Questions about this Data Policy can be sent to info@zoren.ai.