Privacy Policy

The entity responsible for personal information collected through the Site is HANA Health, Inc., a company organized in the United States. You can reach us about privacy at privacy@hana.health. If you are located in the European Economic Area (EEA) or the United Kingdom, see Section 11 for how to contact us and your right to lodge a complaint with a supervisory authority.

We collect the following categories of personal information:

Please do not submit health information, PHI, or other sensitive personal data through the Site’s free-text fields. The Site is for general business enquiries only.

We use personal information to:

• respond to your enquiries and provide the information, demos, or materials you request;
• communicate with you about our products, including sales and account communications;
• operate, maintain, secure, and improve the Site and measure its performance;
• detect, prevent, and respond to fraud, abuse, security incidents, and unlawful activity; and
• comply with legal obligations and enforce our agreements.

Where the GDPR / UK GDPR applies, our legal bases are: performance of a contract or pre-contractual steps (responding to enquiries and demos); legitimate interests (operating, securing, and marketing our business, balanced against your rights); consent (non-essential cookies and certain marketing); and legal obligation (compliance and record-keeping). You may withdraw consent at any time.

We do not sell your personal information for money. We disclose personal information to:

• Service providers / processors who perform services on our behalf under contract, including those listed in Section 5;
• Professional advisers (lawyers, auditors, accountants) where necessary;
• Authorities and third parties when required by law, legal process, or to protect rights, safety, and security; and
• A successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.

See Section 8 regarding analytics “sharing” for cross-context behavioral advertising and your choices.

Each provider is permitted to process personal information only as needed to perform services for us and consistent with this Privacy Policy.

The Site uses cookies and similar technologies for functionality and analytics. For a full inventory, the providers involved, and how to manage your choices, please see our Cookie Policy.

• Contact and enquiry data: retained for as long as needed to handle your request and for a reasonable follow-up period, generally up to 24 months after our last interaction.
• Scheduling data: retained for the duration of the prospective or active customer relationship.
• Analytics data: retained according to the retention period configured in Google Analytics (generally up to 14 months).

We retain personal information longer only where required to comply with legal obligations, resolve disputes, or enforce our agreements, and we delete or de-identify it when no longer needed.

We use analytics and tag-management tools (such as Google Analytics) that may involve “sharing” personal information for cross-context behavioral advertising or analytics under certain US state laws. We do not sell personal information for monetary consideration. You can exercise the following choices:

• Opt out of analytics/advertising cookies through our cookie controls (see the Cookie Policy) and your browser settings.
• We honor the Global Privacy Control (GPC) signal as a valid opt-out of “sale”/“sharing” where required by law.
• Submit a request to privacy@hana.health, or use the contact form.

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit (TLS 1.2/1.3) and at rest (AES-256), access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Security measures applicable to the HANA platform and PHI are described in our Terms of Service & Security Policy and the BAA.

We are based in the United States and use service providers located in the US and elsewhere. If you access the Site from the EEA, the UK, or another region with data-transfer restrictions, your personal information may be transferred to and processed in the United States. Where required, we rely on appropriate safeguards for such transfers, such as the EU-US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses (with the UK Addendum). You may request more information about these safeguards by contacting privacy@hana.health.

11.1 EEA / UK residents

Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to the processing of your personal information; to data portability; and to withdraw consent. You also have the right to lodge a complaint with your local data protection supervisory authority.

11.2 California, and other US state residents

Depending on your state of residence (including California, Colorado, Connecticut, Texas, Virginia, and others), you may have the right to: confirm whether we process your personal information and access it; correct inaccuracies; delete it; obtain a portable copy; and opt out of the “sale” or “sharing” of personal information and of targeted advertising. California residents may also request the categories of personal information collected, the sources, the business purposes, and the categories of third parties to whom it is disclosed, and may limit the use of sensitive personal information. We will not discriminate against you for exercising these rights.

11.3 How to exercise your rights

Submit a request by emailing privacy@hana.health or using our contact form. We will verify your request as required by law and respond within the applicable timeframes. You may use an authorized agent where permitted.

The Site is directed to healthcare organizations and businesses, not to children, and we do not knowingly collect personal information from children through the Site. Health information concerning minor patients that is processed through the HANA platform is handled under the applicable BAA/DPA and the provider’s authority, with parental or guardian consent obtained by the provider. If you believe a child has provided us personal information through the Site, contact privacy@hana.health and we will delete it.

Certain US state laws, including the Washington My Health My Data Act and Nevada SB370, regulate “consumer health data.” We do not use the Site to collect consumer health data for advertising, and we do not sell consumer health data. Where these laws apply and require consent before collecting or sharing such data, we will obtain it. To exercise rights regarding consumer health data, contact privacy@hana.health.

The Site may link to third-party websites and services (for example, scheduling, documentation, or social media). We are not responsible for their privacy practices, and we encourage you to review their privacy notices.

We may update this Privacy Policy from time to time. We will post the updated version here with a new “Last Updated” date and, where required, provide additional notice. Your continued use of the Site after an update constitutes acceptance of the revised policy.