Privacy Policy

Under HIPAA, the facility that uses the platform is the Covered Entity and Orenda Intelligence LLC is its Business Associate. We process protected health information (“PHI”) only to perform the services the facility has engaged us for, and only as its Business Associate Agreement permits.

That has a consequence worth stating plainly: we do not have an independent relationship with a resident, and we cannot act on a resident’s request about their own record on our own authority. Requests for access, amendment, an accounting of disclosures, or a restriction go to the facility, which holds the record. If a resident or a resident’s representative contacts us directly, we will refer them to their facility and tell the facility that we did.

Resident information, from two sources: referral packets and other documents a facility uploads, and, where a facility connects one, a read-only feed from its electronic medical record. This includes identifiers, clinical history, diagnoses, medications, assessments, orders, notes, and payment and coverage information.

Staff account information: name, work email, role, facility assignment, authentication factors, and sign-in and access history.

Business contact information, from the walkthrough request form and ordinary business correspondence: name, role, work email, and the number of facilities and licensed beds a prospective customer operates.

Operational records: audit entries, request metadata, and error diagnostics. These are deliberately kept free of clinical content; see Section 5.

We do not use advertising identifiers, we do not sell information of any kind, and we do not track visitors across other websites.

The public site is deliberately plain. We do not run advertising pixels, session-replay tools, cross-site trackers, or third-party analytics that build a profile of you.

The site sets no cookies of its own. When you sign in, your session is held in your browser tab’s own storage rather than in a cookie, and it is cleared when you sign out or close the tab. Sessions end after fifteen minutes without activity, and after two hours in any case.

Do not send protected health information through the walkthrough request form. It is an ordinary web form on the marketing site, not part of the PHI-covered architecture described in Section 7. If you want us to run a real packet on a call, bring a synthetic or redacted one.

Every record in the platform carries the identifier of the facility it belongs to, and every request is scoped to the facility of the account making it. An administrator’s privileges are a grant inside their own facility; they do not widen that boundary.

Uploaded documents are stored under a per-facility prefix. A request for a document outside the caller’s own prefix is answered as though the document does not exist, because confirming that another facility holds it would itself be a disclosure.

Our diagnostic logs contain no resident names, medical record numbers, dates of birth, or clinical content, and neither do our error messages. Request logging records the method, the path, the status, and the timing, and never a body. This is enforced in code rather than by policy, because a log is the copy of a record that is hardest to account for and easiest to replicate.

Access to PHI is recorded instead in an append-only audit log that contains every view, list, export, and change, with the acting account, the facility, the record, the source address, and the time. Entries are never edited and never deleted.

The platform drafts clinical documentation and assessments using large language models. Four things about that are load-bearing.

Inference runs on Amazon Bedrock inside our own AWS account, under a signed Business Associate Agreement with AWS. Prompts and completions are not retained by the model provider and are not used to train any model. We do not route PHI to any model provider that is not covered by a BAA.

Direct identifiers are stripped before a clinical assessment is sent. Our assessment tools are built to run on age, sex, and admission date; medical record numbers, names, and dates of birth are removed from the material the model receives, and the prompt instructs the model not to reproduce identifiers it may nonetheless encounter in the body of an uploaded document. This is minimization, not de-identification under 45 C.F.R. § 164.514. What goes to the model is still PHI and is still protected as PHI.

Model output is a draft. It is not a diagnosis, not a clinical decision, and not a determination of medical necessity. Nothing it produces enters a resident’s medical record unless a named, licensed clinician has read it, edited or accepted it, and signed it. There is no setting that turns that off and we will not build one.

We do not train on customer data. Not to improve the platform, not to build a general model, not for anyone else. What we do use is de-identified information created in accordance with 45 C.F.R. § 164.514(a)–(b), and operational telemetry that contains no clinical content. We do not attempt to re-identify de-identified information, and we do not publish anything traceable to a facility or a resident.

Traffic is encrypted in transit at TLS 1.2 or above; stored data and backups are encrypted at rest with managed keys. Uploaded documents travel from the browser directly to encrypted object storage over a short-lived signed URL, so a referral packet is never buffered in our application servers.

Accounts authenticate with a password and, where enrolled, a second factor. Roles such as clinician, administrator, and auditor are enforced per route, not only in the interface. A password change or an explicit revocation signs every other device out immediately. Responses carrying resident information are served with no-store caching directives, so a shared browser or proxy retains nothing after sign-out.

No control set makes a system incapable of being breached. If a breach of unsecured PHI occurs, we will notify the affected facility without unreasonable delay and within the period its Business Associate Agreement and HIPAA require, and we will give it what it needs to make its own notifications. As between us and the facility, the facility determines whether an incident is a Breach and makes any notifications to individuals, the Secretary, and the media.

We keep the list short on purpose. Compute, storage, database, authentication, logging, and model inference all run in our own Amazon Web Services account in the United States, under a BAA with AWS.

We do not send PHI to analytics providers, advertising networks, customer-messaging tools, or offshore support vendors. We will not add a subprocessor that receives PHI without a BAA in place with it, and we will tell affected facilities thirty days before we do, so that a facility with a documented privacy or security objection has time to raise it. The current list is available on request.

Audit and compliance records are retained for six years, which is what 45 C.F.R. § 164.316(b)(2) requires of documentation. Resident information is retained for as long as the facility’s agreement provides and it remains necessary for the services.

When an agreement ends, the facility has thirty days to export its data through the platform. After that we return or destroy the PHI we hold at the facility’s direction, except where retaining it is required by law or where it sits in archival backups that expire on their ordinary rotation, in which case we keep protecting it under the same terms and limit further use to the purpose that requires the retention. We will certify destruction in writing on request.

If you are a resident asking about your health record, Section 1 is your answer: the request goes to your facility, which holds the record and can act on it. We cannot.

If you are a member of a facility’s staff, a business contact, or a website visitor, the information we hold about you is not PHI, and California law gives you rights in it. California’s employee and business-to-business exemptions expired on 1 January 2023, so these rights apply to workplace and business contact information too.

Under the California Consumer Privacy Act, California Civil Code §§ 1798.100 et seq., you may request to know what we have collected about you, to delete it, to correct it, and to opt out of sale or sharing — and we can tell you the answer to that last one now, which is that we do not sell or share personal information and never have. We do not use or disclose sensitive personal information for any purpose that triggers the right to limit under § 1798.121. You may also ask us not to retaliate for exercising a right, and we will not.

Where we process staff account information on a facility’s instructions, we act as that facility’s service provider under Civil Code § 1798.140(ag), and we will route your request to the facility rather than answer it ourselves. Where we act on our own account — for example, with a business contact or a website visitor — we will answer it directly.

To make a request, write to admin@axisorenda.com with enough detail for us to locate the information. We will verify your identity in proportion to the sensitivity of what you are asking for, respond within forty-five days, and tell you if we need the additional forty-five days the statute allows. An authorized agent may act for you with written permission. We honor Global Privacy Control signals as an opt-out where the statute requires it, though as noted there is nothing to opt out of.

Residents of other states with comprehensive privacy statutes have comparable rights, and we will honor them on the same terms.

California’s Confidentiality of Medical Information Act, Civil Code §§ 56 et seq., may apply to us in our own right, in addition to our obligations as a HIPAA business associate. We do not disclose medical information except as Civil Code § 56.10, the facility’s Business Associate Agreement, and our subscription agreement permit.

The platform is not directed to children and we do not knowingly collect information from anyone under sixteen through this website. Resident records may concern individuals of any age; those are governed by Section 1 and the facility’s Business Associate Agreement, not by this Section.

We will post a revised effective date here when this policy changes, and we will notify facilities directly of a change that materially affects how we handle PHI. Where a facility’s Business Associate Agreement or subscription agreement conflicts with anything on this page, that agreement controls.

Privacy and security questions, including suspected vulnerabilities and state privacy law requests: admin@axisorenda.com. Orenda Intelligence LLC, Campbell, California, United States.

We will not pursue a claim against a person who reports a security vulnerability in good faith, does not access or exfiltrate any facility’s data, does not degrade the platform, and gives us a reasonable period to remediate before disclosing.