Privacy Policy

Introduction

At Pharos Health, we are committed to protecting your privacy and ensuring the security of the personal information we handle. This Privacy Policy describes the information we collect when you visit our website at pharos.health, and separately describes how we handle the health information we process on behalf of our hospital customers.

By using our website, you consent to the data practices described in this Privacy Policy. We review this policy at least annually and may change it from time to time. If we make changes, we will notify you by revising the "Last Updated" date at the top of this policy, and we will not use personal information in a manner inconsistent with the policy in effect when it was collected.

Information we process on behalf of our customers

Pharos provides software to hospitals and health systems. In delivering that service we act as a business associate under the Health Insurance Portability and Accountability Act (HIPAA), processing protected health information and other personal information that our customers make available to us.

We process that information only to provide, maintain, and support the services described in our agreement with the customer, and only as that agreement and the applicable Business Associate Agreement permit. We limit our use and disclosure of health information to the minimum necessary for the purpose. We do not sell it, and we do not use it for advertising or for any purpose unrelated to delivering the service.

We retain this information for as long as the customer agreement requires and delete it in accordance with that agreement. Where an agreement does not specify a period, we securely delete customer data within 60 days of the agreement ending. We engage vendors to help deliver the service, and where a vendor may handle protected health information we put a Business Associate Agreement in place before any information is shared.

The hospital or health system remains responsible for its relationship with patients and for responding to requests about their health information. If you are a patient and want to access, correct, or delete your health information, please contact your hospital directly. When a customer asks us to help them respond to such a request, we support them as our agreement requires. We verify the identity and authority of anyone making a request before disclosing any information.

Information we collect through our website

The remainder of this policy describes the information we collect directly through pharos.health. We collect it to respond to enquiries and to improve our website. The types of information we collect include:

Information you provide to us

• Contact information: When you complete a form on our website, we collect your name, email address, and organization information

• Communications: Information you provide when you contact us for support or other inquiries

Information we collect automatically

We use PostHog, an analytics platform, to collect usage data about how you interact with our website. This helps us understand how our website is being used and how we can improve it. The information collected through PostHog includes:

• Usage data: Information about how you use our website, including pages visited and actions taken

• Device information: Information about the device you use to access our website, such as device type, operating system, and browser type

• Log data: IP address, referring/exit pages, timestamps, and pages viewed

• Cookies and similar technologies: We use cookies to collect information about your browsing activities

How we use your information

We use the information we collect for various purposes, including:

• Responding to enquiries and providing support

• Maintaining and improving our website

• Detecting, preventing, and addressing technical issues and security risks

• Complying with legal obligations

Data storage and security

We implement robust security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. These measures include encryption, access controls, regular security assessments, and employee training on data security practices.

We store your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law. Website analytics data is retained for up to 12 months. Contact information submitted through our forms is retained for as long as we have an active relationship with you or your organization, and is deleted within 12 months of that relationship ending unless we are required to keep it for longer.

Cookies and tracking technologies

We use PostHog analytics to collect information about how visitors use our website. PostHog may use cookies or similar technologies to track visitor information. This information helps us improve our services and enhance user experience.

The data collected may include information such as your IP address, browser type, operating system, referring pages, pages visited, and time spent on our website. This information is used in aggregate form to analyze usage patterns and improve our service.

Sharing your information

We do not sell your personal information to third parties. We may share your information in the following circumstances:

• With service providers: We may share information with third-party vendors who perform services on our behalf, such as hosting, analytics, and customer support

• For legal reasons: We may share information if we believe disclosure is necessary to comply with the law, enforce our agreements, or protect the rights, property, or safety of Pharos, our users, or others

• With your consent: We may share information with third parties when you give us your consent to do so

• Business transfers: If Pharos is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction

Your rights and choices

Depending on your location, you may have certain rights regarding your personal information:

• Access: You may request access to the personal information we have about you

• Correction: You may request that we correct inaccurate or incomplete information

• Deletion: You may request that we delete your personal information

• Restriction: You may request that we restrict the processing of your information

• Data portability: You may request a copy of your information in a structured, commonly used, and machine-readable format

• Objection: You may object to our processing of your information

To exercise these rights, or to raise a concern or complaint about how we handle your personal information, please contact us using the form at the bottom of this page. Requests and complaints are directed to our Privacy Officer. We verify identity before acting on a request and will acknowledge it within 30 days. We do not retaliate against anyone for raising a privacy concern.

You can control cookies through your browser settings. Most browsers allow you to refuse or accept cookies and to delete them. However, if you disable cookies, some features of our website may not function properly.

Children's privacy

Our website is not intended for children under 13 years of age, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information.