Wayvera Privacy Policy

1. Important Note About Health Information (HIPAA)

Wayvera (operated by Abella, LLC) provides software to healthcare organizations that support Medicare care management and billing workflows. When we handle Protected Health Information ("PHI") on behalf of a healthcare provider or other covered entity, we generally act as a Business Associate under the Health Insurance Portability and Accountability Act ("HIPAA").

In that role, our handling of PHI is governed by HIPAA and by the Business Associate Agreement ("BAA") we enter into with the customer organization — not by this Privacy Policy. This Privacy Policy describes the information we collect and use in our own right, such as account information, website and app usage data, and information from prospective customers.

If you are a patient whose information is processed through the Service, the healthcare organization providing your care — not Wayvera — controls that information and is responsible for its own privacy notices and your rights regarding it. Please contact that organization with questions about your health records.

2. Who This Policy Covers

This policy applies to:

• Authorized Users (such as clinicians, care team members, and administrators) who access the Service on behalf of a customer organization; and
• Visitors and prospective customers who interact with our websites, marketing, or sales communications.

3. Information We Collect

Information you provide to us, which may include:

• account and profile information (name, work email, phone number, job title, organization);
• authentication credentials;
• communications you send us (support requests, feedback, inquiries); and
• billing and payment details for subscriptions (which may be processed by a third-party payment provider).

Information collected automatically when you use the Service, which may include:

• device and app information (device type, operating system, app version, unique device identifiers);
• log and usage data (features used, actions taken, timestamps, pages viewed);
• IP address and general location derived from it; and
• information collected through cookies and similar technologies on our websites.

Protected Health Information. PHI entered into the Service by customer organizations is processed on their behalf and is governed by HIPAA and the applicable BAA, as described in Section 1. We do not use PHI for advertising, and we do not sell PHI.

4. How We Use Information

We use the information described above (other than PHI, which is used only as permitted by the BAA and HIPAA) to:

• provide, operate, maintain, and secure the Service;
• authenticate users and manage accounts;
• process subscriptions and payments;
• respond to inquiries and provide customer support;
• monitor, troubleshoot, and improve the Service, including through analytics;
• send administrative and, where permitted, marketing communications (you may opt out of marketing); and
• comply with legal obligations and enforce our Terms.

We may use aggregated or de-identified information — which does not identify any individual — for analytics, benchmarking, and product improvement.

5. How We Share Information

We do not sell personal information. We may share information as follows:

• Service providers / subprocessors. With vendors who perform services on our behalf (such as cloud hosting, analytics, and payment processing), bound by contractual confidentiality and, where applicable, HIPAA obligations.
• Customer organizations. With the customer organization on whose behalf an Authorized User accesses the Service.
• Legal and safety. When required by law, subpoena, or legal process, or to protect the rights, safety, or property of Wayvera, our users, or others.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to appropriate protections.

Any sharing of PHI is limited to what is permitted under HIPAA and the applicable BAA.

6. Data Retention

We retain personal information for as long as needed to provide the Service, comply with legal and contractual obligations, resolve disputes, and enforce our agreements. Retention and return or destruction of PHI are governed by the applicable BAA. When information is no longer needed, we take reasonable steps to delete or de-identify it.

7. Data Security

We maintain administrative, technical, and physical safeguards designed to protect information against unauthorized access, disclosure, alteration, and destruction, consistent with applicable law and, for PHI, the HIPAA Security Rule. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Choices and Rights

• Access, correction, and deletion. You may request access to, correction of, or deletion of personal information we hold about you by contacting us at contact@abella-health.com. Where the information constitutes PHI held on behalf of a customer organization, we will direct your request to that organization.
• Account deactivation and deletion. Accounts are provisioned and managed by the customer organization that authorizes your access; the Service does not offer public or self-service account creation. To deactivate or delete your account and associated personal information, contact your organization's administrator, who can disable your access, or contact us at contact@abella-health.com and we will coordinate with your organization to process the request. Information that constitutes PHI, or that we are required to retain by law, is handled in accordance with HIPAA and the applicable Business Associate Agreement.
• Marketing communications. You may opt out of marketing emails using the unsubscribe link or by contacting us.
• Cookies. You can manage cookies through your browser settings; disabling some cookies may affect site functionality.

9. U.S. State Privacy Rights

Depending on where you live, you may have rights under state privacy laws (such as the California Consumer Privacy Act, as amended, and similar laws in other states) to know, access, correct, delete, and limit certain uses of your personal information, and to not be discriminated against for exercising those rights. Note that information governed by HIPAA and certain health-related data may be exempt from these laws. To exercise applicable rights, contact us at contact@abella-health.com. We will verify your request as required by law.

10. International Users

The Service is intended for use in the United States, and information is processed and stored in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States.

11. Children's Privacy

The Service is intended for use by healthcare professionals and is not directed to children. We do not knowingly collect personal information directly from children under 13 through the Service. (Health information about pediatric patients that a customer organization enters as PHI is handled under HIPAA and the applicable BAA, not this policy.)

12. App Store and Device Permissions

When you use our mobile application, the app may request device permissions (such as notifications or network access) to function. You can manage most permissions through your device settings. Information collected through the app is handled as described in this policy and, where applicable, the BAA. We do not use health data for advertising or share it with data brokers.

13. Third-Party Links and Services

The Service may link to or integrate with third-party websites and services that we do not control. Their privacy practices are governed by their own policies, and we encourage you to review them.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated policy with a new effective date and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance.

15. Contact Us

If you have questions or requests regarding this Privacy Policy or our privacy practices, contact: