Platform Privacy Policy

Effective Date: August 11, 2026 

This Platform Privacy Policy explains how OrganOptima LLC (“OrganOptima,” “we,” “us,” “our”) collects, uses, and protects information when you use the OrganOptima patient communication platform (the “Platform”).

1) How This Policy Relates to Your Provider’s HIPAA Notice

If you use the Platform to communicate with a health care provider (“Provider”), information submitted through the Platform may include protected health information (“PHI”).

Your Provider’s HIPAA Notice of Privacy Practices (“NPP”) explains how the Provider may use and disclose your PHI.

OrganOptima processes PHI on behalf of Providers and in accordance with applicable agreements and Provider instructions.

This Platform Privacy Policy does not replace the Provider’s NPP.

2) Information We Collect
Depending on Provider configuration and your Platform use, we may collect:

A) Account and Authentication Information

    • Name and email address
    • Phone number (if used for verification or notifications)
    • Username and password (stored using industry-standard hashing where applicable)
    • Multi-factor authentication (MFA) information (e.g., delivery method, verification logs)
    • Single sign-on (SSO) identifiers and assertions (where SSO is enabled)

B) Platform Content

    • Messages and attachments sent through the Platform (which may include health information)
    • Provider responses and care-related communications
    • Message metadata (timestamps, delivery status)

C) Technical, Security, and Audit Information

    • Device and browser information necessary to provide secure access
    • IP address, access logs, audit logs, and security event logs
    • Session identifiers and authentication tokens required for Platform security

D) Notification Information

    • If enabled, we may use your email address and/or phone number to send Platform notifications, such as new message alerts and reminders, consistent with your settings and Provider configuration.

3) How We Use Information
We use information to:

    • Provide, operate, maintain, and secure the Platform
    • Authenticate users (email/password, MFA, SSO)
    • Deliver messages and attachments between you and your Provider
    • Send Platform notifications if enabled (email/SMS)
    • Monitor and protect Platform security (fraud prevention, abuse detection, audit logging)
    • Troubleshoot and provide support to Providers and authorized users
    • Comply with legal obligations and enforce Platform terms

4) EHR Integration (Future)
If the Platform integrates with an electronic health record (“EHR”) system in the future, information may be exchanged between the Platform and the EHR as directed by the Provider and consistent with applicable agreements and law. We will update this Policy as needed to reflect material changes.

5) Tracking Technologies / Analytics

OrganOptima does not use advertising trackers, targeted advertising pixels, or third-party behavioral analytics inside the authenticated Platform.

If OrganOptima maintains separate public marketing pages outside the authenticated Platform, those pages may have different practices; this Policy applies to the authenticated Platform unless explicitly stated otherwise.

6) How We Share Information
We may share information:

    • With your Provider and Provider-authorized staff involved in your care and platform administration.
    • With service providers (“subprocessors”) that help us operate the Platform (e.g., hosting providers; email/SMS delivery providers), under contracts requiring them to protect information and use it only to provide services to OrganOptima.
    • For legal and safety reasons when we believe disclosure is required by law or necessary to protect rights, safety, and security of OrganOptima, Providers, users, or the public.

We do not sell Platform user information.

7) Data Security
We maintain administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Platform data, including access controls and audit logging.

No method of transmission or storage is 100% secure. However, we work to protect information using reasonable and appropriate measures.

8) Data Retention
We retain Platform information as long as needed to provide the Platform and meet legal, security, and contractual obligations. Retention of medical record content and PHI is ultimately determined by the Provider’s policies and applicable law.

9) Your Choices

  • Notification Preferences
    If enabled, you may manage message alerts (email/SMS) through your Platform account settings and/or by contacting your Provider.
  • Requests Related to Your Medical Record
    To request access, correction, or deletion of information that is part of your medical record, contact your Provider (your rights and process are described in the Provider’s NPP).
  • Platform Support
    For technical account issues (e.g., login problems), contact OrganOptima Support:
    • Email: Support@organoptima.com
    • Phone: +1 (248) 835-0040

10) Children
The Platform is intended for patients of participating Providers and not for use by children without involvement of a parent/guardian where required by law and Provider policy. Providers may permit proxy access consistent with their policies.

11) Changes to This Policy

We may update this Platform Privacy Policy from time to time. We will revise the “Last Updated” date and, if changes are material, provide appropriate notice within the Platform.

12) Account Deletion
You can delete your Kidney Call account in the app (Account → Profile → Delete My Account). See https://organoptima.com/account-deletion/ for details.

13) Contact Us

OrganOptima LLC
Address: 1209 Orange Street, Wilmington, DE 19801
Email: Support@organoptima.com
Phone: +1 (248) 835-0040