HIPAA Notice

This notice explains Zoren AI’s role and practices under the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”). Please read Section 1 carefully — it explains an important distinction between this notice and the “Notice of Privacy Practices” you receive from your own doctor, pharmacy, or health plan.

1. About this notice

Zoren AI is generally not your healthcare provider, pharmacy, or health plan. We provide software that healthcare organizations and pharmacies (“Customers”) use to prepare and submit prior-authorization and related requests. Under HIPAA, your provider or pharmacy is typically a “covered entity,” and Zoren AI acts as their “business associate” — a vendor that a covered entity uses to help carry out certain administrative functions involving protected health information (“PHI”).

This means the formal “Notice of Privacy Practices” that HIPAA requires covered entities to give patients — describing how your specific provider or pharmacy uses and discloses your PHI, and your rights with respect to that provider — comes from your provider or pharmacy directly, not from us. This page instead describes Zoren AI’s own obligations and practices as a business associate.

2. Our role as a business associate

When a Customer uses the Service to process PHI, we do so under a signed Business Associate Agreement (“BAA”) with that Customer. That BAA requires us, among other things, to:

• Use and disclose PHI only as permitted by the BAA and HIPAA;
• Implement appropriate administrative, physical, and technical safeguards to protect PHI;
• Report security incidents and breaches of unsecured PHI to the Customer as required by the BAA and law;
• Ensure any subcontractor that handles PHI on our behalf agrees to equivalent restrictions and safeguards; and
• Make PHI available to the Customer as needed for the Customer to fulfill its own obligations to patients under HIPAA.

3. How we protect PHI

We maintain a HIPAA-oriented security program, including encryption of PHI in transit and at rest, role-based access controls, audit logging, and organization-scoped data isolation across our multi-tenant platform. Additional technical detail is available in our Data Policy.

4. Your rights as a patient

Because your provider or pharmacy is the covered entity responsible for your care and your PHI, HIPAA rights such as the right to access your records, request corrections, request an accounting of disclosures, or request restrictions on certain uses and disclosures should be exercised directly with your provider or pharmacy, not with Zoren AI. If your provider or pharmacy uses the Service to process a request on your behalf, we will assist that provider or pharmacy in responding to your request as required by our BAA with them.

5. Breach notification

If we discover that unsecured PHI has been breached, we will notify the affected Customer(s) without unreasonable delay, consistent with the timeframes in the applicable BAA and the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414). Your provider or pharmacy is generally responsible for notifying affected patients, as required by law.

6. Filing a complaint

If you believe your privacy rights have been violated, you should first contact your healthcare provider or pharmacy. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, without fear of retaliation:

• Online: the HHS Office for Civil Rights complaint portal at hhs.gov/ocr/complaints
• By mail: U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, D.C. 20201

[Placeholder — confirm current OCR contact details before publishing, as government contact information can change.]

7. Changes to this notice

We may update this notice from time to time to reflect changes in our practices or applicable law. Material changes will be reflected in the “Last updated” date above.

8. Contact us

Questions about our role as a business associate can be sent to info@zoren.ai. For questions about your own PHI, please contact your healthcare provider or pharmacy directly.