InteroCloud Privacy Policy

Notice to Patients

If you are a patient of one of our Subscriber clinics or practitioners, your clinic or practitioner controls your patient information, including your contact information, billing details and patient records. Please contact your clinic or practitioner for any questions about your patient information.

Information InteroCloud Collects from You

Contact Information. We collect your contact information, such as your name, email address and organization, when you fill out our online forms or set up your user account for our Services. We use your contact information to activate your user account, give you access to the Services, and to send you notices about your user account. We may also use your contact information for marketing purposes, such as promotional emails, direct mail and sales contacts. You can opt-out of our marketing communications at any time by unsubscribing or contacting us at office@interocloud.com. Please note that InteroCloud does not collect or manage the contact information of patients, or any marketing or other communications between a Subscriber and its patients.

Billing Information. When a Subscriber subscribes to our Services, we also collect credit card information to process payment and other payment information where required. Credit card information is provided directly to our payment processor and is processed in a PCI DSS -compliant manner. We do not keep your credit card information.

Log and Device Information. When you access and browse our Services, we collect information about how you are accessing our Services, such as your internet or mobile network connection, your browser or the type of mobile device you are using (if applicable). We use this log and device information to identify how our Services are being accessed and used so we can optimize them for the types of connections, browsers and devices being used. This information is not used to market or send promotions at an individual user level.

Cookies and Tracking Information. Our website uses cookies. Cookies are small data files that are downloaded to your computer or device by a website. Your web browser lets you manage cookies through its “settings” or “options” menus. You can change your browser settings to display a warning before accepting a cookie or to refuse all cookies. You can also delete cookies at any time; however, please note that certain cookies must remain in order to use certain portions of the Services. We also use web beacons, which are tiny graphic objects embedded in a web page or an email which allows us to determine if a user has viewed the web page or email.

We use cookies and web beacons:

• To learn about use of our websites, such as user traffic patterns and the effectiveness of our navigational structure
• To identify email open rates in order to gauge the effectiveness of certain communications or marketing campaigns to clinics
• To allow you to login to secure areas of our Services
• To store your login credentials for easy access to our Services

For more information about cookies, see our Cookie Policy.

Legal Basis (GDPR EU/UK)

For personal information that is subject to the General Data Protection Regulation (GDPR), we rely on the following legal bases for collecting and using your personal information:

• Your consent;
• Our legitimate interests (which are not overridden by your privacy rights), such as operating our business, understanding and improving our Services, direct marketing related to our Services, communicating with our Subscribers and users about our Services, events or related resources, improving our websites and protecting our legal rights and interests;

Contract performance or legal obligation are relied upon where we need your data to provide you the Services, including to operate the Services, provide customer support and personalized features and to protect the safety and security of the Services;

You may withdraw your consent at any time. Where we are using your personal information for our legitimate interests, you have the right to object to that use. See below under Your Rights for how to withdraw consent or object.

If you are a patient of one of our Subscriber clinics, please contact your clinic or practitioner if you have any questions about the legal basis for collecting and using your personal information. Our Subscribers may have a different legal basis for collecting and using a patient’s personal information, such as providing health care or treatments as a regulated healthcare professional.

Patient Data

Patient Data. Subscribers use our clinic management platform to collect personal information from their patients and create patient records. These records may include a patient’s name, address, health insurance and billing information, medical charts, appointment history and other patient data (“Patient Data”). This information is sometimes referred to as “personal health information”, “protected health information”, “data concerning health” or “sensitive data” depending on the location of the Subscribers and the privacy laws applicable to them. If you are a patient, Patient Data is collected from you when you visit your Subscriber clinic or practitioner.

Subscriber’s Role. Subscribers retain sole control over Patient Data and may be referred to as a “health information custodian”, a “covered entity” or a “controller” depending on their location and the privacy laws applicable to them.

Subscribers determine:

• What Patient Data to collect;
• How the Subscriber will use the Patient Data;
• Who has access to Patient Data;
• How long the Subscriber will store Patient Data; and
• On what basis the Subscriber may delete Patient Data.

Subscribers are responsible for complying with laws and regulations governing the use of Patient Data, and for determining the legal basis for such use.

InteroCloud’s Role. InteroCloud is a service provider to Subscribers and may be referred to as an “agent”, “business associate” or “processor” of the Subscriber. InteroCloud stores Patient Data in its secure data centers and makes it available to Subscribers and their users through our clinic management platform. InteroCloud otherwise has no control over Patient Data. InteroCloud will only access and intervene over Patient Data on the instructions of the Subscriber or its practitioners or staff or, in rare cases, where needed in order to prevent or address technical problems or if required by law or court order.

Storage Location. Patient Data is stored on the Amazon Web Services (AWS) data centers on the European Union territory. All data centres and service providers maintain a high level of security and are compliant with applicable privacy laws.

Sharing Your Information

We do not sell or distribute personal information to third parties for their or our own commercial or marketing purposes. We will only share personal information we collect in the following circumstances:

Suppliers and Service Providers. In order to operate our business and provide the Services to our Subscribers and their users, we may need to share a limited amount of personal information, including Patient Data, with our third-party suppliers and service providers. Before sharing personal information, we ensure that the third parties receiving the personal information have provided appropriate safeguards, and that privacy rights are protected and preserved. Some of the areas where we use third-party suppliers and service providers include:

• Our data centers where all platform data is stored
• Customer support services to help us collect feedback and manage our support services
• Communication services to send out email and SMS notices or reminders
• Payment processor

Corporate Transactions. We may share personal information in connection with negotiating or carrying out a financing or acquisition of our business, a merger or amalgamation with another business, or a sale of all or part of our company assets. Before sharing personal information, we will ensure that appropriate confidentiality and non-disclosure undertakings are in place. We will not share Patient Data in these circumstances.

Compliance with Laws. We may disclose personal information to a third party if we are required to do so by applicable law, government request, court order or regulatory body. We may also be required to disclose personal information to enforce our legal rights, to enforce security requirements, or to respond to an emergency which we believe, in good faith, requires us to disclose personal information. In such instances, if permissible, we will make every reasonable effort to give you as much notice as possible regarding the disclosure of your personal information, what information was disclosed and why. We will not disclose Patient Data unless legally required to do so.

Anonymized/Aggregated Data. InteroCloud may use computer-generated algorithms to gather anonymous and aggregated information from our Subscribers and their Patient Data in order to assist in our continued development and improvement of the Services, and for research, data analysis, benchmarking, statistics or trend analysis. We will ensure that none of the information we gather identifies, or could be used to identify, any user or patient. InteroCloud may share such anonymized information with Subscribers and others, for example, by providing insights into most common conditions, most popular treatments or benchmarking fees against industry or regional norms.

Security

We protect your personal information, including Patient Data stored in our platform, by:

• Using industry standard security controls such an encryption and an SSL (Secured Sockets Layers) certificate to ensure information is transmitted over a secured connection between your browser and our web server.
• Using state-of-the-art data centres with appropriate security and compliance certifications, such SOC 2 and EU-US certifications that are GDPR compliant.
• Having our personnel sign strict non-disclosure agreements to ensure they understand the confidential nature of the data we process, and only accessing your account when you request assistance from us.
• Requiring password protection of your user account with a password set by you. We cannot access or identify your password. The only way to recover a password is for you to initiate a reset via the email address you use for the Services.

While we employ industry standard measures to protect your information, no electronic communication can ever be completely secure. You share responsibility for protection of your personal information by setting a strong password and by keeping your username and password confidential.

Storage Period

We retain personal information only for as long as necessary to achieve our stated purposes, or as required by applicable law. For example, Contact and Billing information is kept for as long as a Subscriber account is active and for a reasonable period after it has been deactivated in the event you or your Subscriber wish to re-activate the account. User account information may also be retained as necessary to comply with our legal obligations, resolve disputes or maintain our relationship with your Subscriber organization. Credit card information is never kept or stored by us.

If you are a patient of one of our Subscriber clinics, please contact your clinic or practitioner for information regarding the storage period for your Patient Data.

Your Rights

Individuals have certain rights with respect to their personal information. These rights are set out below. If you are a patient of one of our Subscriber clinics, please contact your clinic or practitioner to exercise any of these rights with respect to your Patient Data.

Correction and Deletion. We will make reasonable efforts to ensure that the personal information we collect from you is accurate and complete. You may update, correct or delete your account information at any time by logging into your user account and modifying your personal information, including your preferences to receive messages from us. You may also update, correct or delete your personal information by contacting us as noted below.

Withdrawing Consent. Where we have relied on your consent to use your personal information, you have the right to withdraw that consent at any time by contacting us as noted below. In addition, all our marketing email messages contain the ability to automatically “opt-out” or unsubscribe from our mailing lists and marketing messages.

Access and Portability. You have the right to request a record of the personal information that we have collected about you and to ask that the information be provided in a structured, used electronic format (where applicable and technically feasible). There may be some cases where we cannot provide you with certain information about you if it would mean disclosure of personal information of another person or other confidential information, or if it would compromise our security systems. If you require access to your personal information, please contact us. We will do our best to respond within thirty (30) days of receiving your request. We may charge a fee where permitted by applicable law.

Restriction and Objection. In certain limited circumstances, individuals in the EU may request that we restrict our use of their personal information and, where we rely on legitimate interests as the legal basis for using your personal information, you have the right to object to such use. In these cases, we can be required to no longer use your personal information; however, this may mean that certain components of our Services cannot be made available to you. If you wish to exercise your right to restrict or object, please contact us.

Complaints. You have the right to lodge a complaint with a supervisory authority (i.e., the independent public authority responsible for monitoring data protection laws in your country).

Contact Us

If you have any questions or concerns about our Privacy Policy and our privacy practices, please contact us at:

InteroCloud Limited
First Floor, Penrose 1.
Penrose Dock, Cork
T23 KW81, Ireland
Tel: +353 21 234 0088
Email: office@interocloud.com

Attention: Privacy Officer

Updated: April 1st, 2023