Privacy Policy

1. Introduction

Revive Medical Solutions LLC ("Revive," "we," "us," or "our") provides web portals and related technology and services to medical-product distributors and health care practices. This Privacy Policy describes how we collect, use, disclose, and protect information when you visit our website or use our portals and services (together, the "Services").

It applies to visitors to our website and to users of our Services, including distributors, health care practices, sales representatives, and their authorized personnel.

2. Information We Collect

Information you provide:

• Contact and account information: name, email address, phone number, organization, role.
• Professional information: practice details and specialties.
• Order and transaction information entered in our Services.
• Your communications with us, such as support requests.

Information collected automatically:

• Log information: IP address, browser type, pages visited, timestamps.
• Device information: operating system and browser.
• Website analytics: our public website uses Google Analytics to understand how the site is used. Our public website does not collect PHI, and analytics tools are not used inside our customer portals.

Protected Health Information (PHI): see section 5.

3. How We Use Information

We use information to provide, operate, secure, and improve the Services; process orders; communicate with you about your account and the Services; send industry updates you can opt out of; prevent fraud; and comply with legal obligations, including HIPAA.

4. How We Share Information

We do not sell, rent, or trade personal information. We share it only:

• with service providers that help us operate the Services, under written agreements that require them to protect it, and, where they handle PHI, under a business associate agreement with Revive;
• when required by law, or to respond to lawful requests from public authorities;
• to protect the rights, property, or safety of Revive, our customers, or others; and
• in connection with a merger, acquisition, or sale of assets, subject to equivalent protections.

5. Protected Health Information

When we provide the Services to a health care organization, we may create, receive, maintain, or transmit PHI on its behalf as a business associate under HIPAA. Our handling of that PHI is governed by HIPAA and by our agreements with that organization, and this Privacy Policy does not modify those obligations.

• PHI is held in our customer portals and in the HIPAA-eligible services we use to run them (application hosting, database, and document storage), each under a business associate agreement with Revive. Health care organizations sometimes send PHI to our staff by email. That email is held in our business email system, which is also covered by a business associate agreement with Revive.
• Automated email and text-message notifications from our portals do not include PHI. They contain a link to sign in to the portal.
• We do not sell PHI or use it for marketing.
• If you are a patient and want to access, correct, or receive an accounting of your health information, please contact the health care organization that provided your care. We will support it as our agreements and HIPAA require.

6. How We Protect Information

We use administrative, physical, and technical safeguards appropriate to the information we hold, including:

• encryption of data in transit and at rest in our production systems;
• multi-factor authentication for Revive staff accounts and for portal sign-in with a password (when users sign in with Google or with their organization's single sign-on, two-step verification is applied by that identity provider);
• role-based access controls within our portals;
• audit logging of access to PHI in our portals;
• automated scanning of our software dependencies for known vulnerabilities;
• regular backups, with tested restore procedures; and
• documented procedures for identifying, reporting, and responding to security incidents.

7. Retention

We keep information only as long as needed to provide the Services and meet our legal and contractual obligations, as set out in our Data Management Policy. When a customer relationship ends, we delete that customer's data, including backups, within 30 days, except (a) information we are required by law to keep, which remains protected under this policy and our agreements, and (b) information that has been de-identified under HIPAA so that it no longer identifies any individual.

8. Your Choices and Rights

Subject to applicable law, you may ask to access, correct, or delete personal information we hold about you, opt out of marketing emails at any time, and raise a concern with us or a regulator. For PHI, see section 5.

9. Children

The Services are not directed to individuals under 18, and we do not knowingly collect personal information from children.

10. Third-Party Sites

Our website may link to other sites. Their privacy practices are governed by their own policies.

11. Changes

We may update this Privacy Policy. We will post the updated version here with a new effective date, and will notify customers of material changes.

12. Contact Us

Email: compliance@revivemedicalsolutions.com
Phone: 414-209-4078

For HIPAA matters, contact our HIPAA Security Officer at the email address above.