Privacy Notice
Effective date: August 22, 2026
This notice describes current practices of the platform as built. It has not been reviewed or approved by legal counsel and must be reviewed by qualified legal and compliance advisors before production use with real data.
1. Identity
Who we are. AOR ONE™ CARE AUTHORITY™ is a proprietary platform of AOR Medical Solutions. Founder, Owner and Lead Developer: Américo Ortiz Rivera.
2. Scope of this notice
What it covers. This notice covers the public website of the platform and the demonstration environment. Handling of protected health information in a production deployment is governed by the applicable Business Associate Agreement and the customer organization's own policies.
3. Demonstration environment and synthetic data
Synthetic only. All patient and operational information shown in the demonstration environment is synthetic. Real clinical information must not be entered until production controls are configured and authorized.
4. Information that may be collected
Categories. Corporate contact information you submit, authentication information for authorized users, and operational records created by authorized users within their organization.
5. Prospect corporate information
Commercial forms. Demonstration and contact requests collect business information: name, corporate email, organization, job title, organization type, region, area of interest, approximate operation size and an optional message.
6. Technical and navigation information
Operational logs. The hosting and database providers generate technical logs necessary to operate and secure the service. The platform does not deploy advertising trackers or third-party marketing analytics.
7. Authentication information
Credentials. Authentication is handled by the managed identity provider. Passwords are never stored by application code and are never present in browser code.
8. No PHI in public forms
Express restriction. Public forms must never be used to transmit protected health information, patient identifiers, clinical records or credentials. Any such content received may be deleted.
9. Purpose of use
Why we process. To respond to commercial and institutional requests, to operate and secure the platform, to provide the contracted service to authorized organizations and to maintain auditability of operational actions.
10. Service providers
Categories. Cloud hosting, managed database and authentication, private document storage, transactional email delivery, and a managed AI gateway used for drafting and transcription assistance. Provider agreements applicable to production PHI handling must be executed before production use.
11. Retention
Periods. Commercial requests are retained while a business relationship is being evaluated. Operational and audit records are retained according to each organization's configured retention policy.
12. Access controls
Least privilege. Access is scoped by organization and by role, enforced at the database layer, and limited to what a role requires.
13. Audit records
Traceability. Access events and state changes are written to an append-only audit trail available for compliance review.
14. Transfers and integrations
Current state. External clinical, payer, fax, SMS and carrier integrations are not enabled. When enabled, transfers will require configuration, authorization and, where applicable, an executed agreement.
15. Privacy requests
How to request. Corporate contacts may request access to, correction of, or deletion of the business information they submitted, through the corporate contact page.
16. Security and privacy contact
Channel. Security findings should be reported through the responsible disclosure page. Privacy questions should be routed through the corporate contact page.
17. Changes to this notice
Updates. This notice may be updated as the platform evolves. The effective date above reflects the most recent update.
18. Corporate information versus PHI
Distinction. Business contact information submitted by a prospect is not protected health information. The two are handled under different controls and must never be mixed in public forms.
19. DEMONSTRATION ENVIRONMENT — ALL PATIENT AND OPERATIONAL DATA IS SYNTHETIC
All patient and operational information displayed in the demonstration environment is synthetic.
AOR ONE™, CARE AUTHORITY™, AOR HealIQ™ and associated systems are proprietary platforms and intellectual property of AOR Medical Solutions.