Effective Date: October 25, 2025
This Privacy Policy ("Policy") describes how Auth Hero, Inc. ("Auth Hero," "we," "our," or "us") collects, uses, and discloses personal information when you use our websites, web and mobile apps, and related services that coordinate documents, messages, tasks, and audit logs across workers' compensation stakeholders in California (collectively, the "Services").
Auth Hero is built for California workers' comp clinics and the stakeholders they invite (patients, employers, attorneys, payers, nurse case managers). We are not an electronic medical record (EMR) and we do not provide medical care. In most cases, we act as a Business Associate to Covered Entities (e.g., clinics) under HIPAA and as a Service Provider under the California Consumer Privacy Act, as amended by the CPRA (together, "CCPA/CPRA").
California only. Auth Hero currently operates in the State of California. If you access the Services from outside the U.S., you do so at your own initiative and any data will be stored and processed in the United States.
When we handle Protected Health Information ("PHI") on behalf of a Covered Entity (e.g., clinic), we do so pursuant to a Business Associate Agreement ("BAA"). The clinic's Notice of Privacy Practices (NPP) governs how the clinic uses and discloses PHI; this Policy explains Auth Hero's privacy practices for our platform.
PHI processed under a BAA is not subject to certain state consumer privacy rights (e.g., CCPA/CPRA) to the extent those laws exclude PHI handled under HIPAA. Where information is not PHI, CCPA/CPRA rights described below may apply.
The categories we collect depend on how you use the Services and your role (clinic staff, patient, employer, attorney, payer, etc.). Information may be collected from you, your clinic/employer/attorney/payer, or automatically via the Service.
Name, contact details, role, organization, job title, user credentials, multi-factor settings.
Workers' comp case identifiers; RFAs, referrals, medical notes, prior authorizations, imaging reports, progress notes, work status forms; comments, tags, and metadata; version history; who uploaded/viewed/modified documents and when.
Case-linked messages and attachments; task assignments, due dates, completion status; notification history.
Full audit trails (access logs, permission changes, exports), retention flags (e.g., legal hold), consent/authorization artifacts provided by clinics or other stakeholders.
Billing contact info, business addresses, purchase history (for clinic subscriptions or workplace bundles). We do not store full card numbers—payments are processed by PCI-compliant vendors.
IP address, device/browser type, app events, crash reports, session timestamps, limited diagnostic telemetry. We use only necessary cookies by default; optional analytics are opt-in.
To the extent we process PHI (health information) or government IDs (when provided by a clinic or another permitted source), we protect and restrict such data per HIPAA and applicable California law.
We use personal information to:
We do not sell or share personal information as "sale" or "sharing for cross-context behavioral advertising" are defined by CCPA/CPRA. We do not use PHI for advertising or marketing unrelated to your clinic's instructions.
We disclose personal information only as described below:
We do not disclose PHI to third parties for their independent marketing and do not permit vendors to use PHI for advertising.
Essential cookies support login, security, and core features.
Optional analytics (e.g., product usage to improve UX) are off by default and enabled only with user or customer admin consent.
We do not use cross-site tracking for behavioral advertising.
Most browsers let you control cookies; blocking essential cookies may impair functionality. Our Services do not respond to "Do Not Track" signals.
We implement administrative, technical, and physical safeguards aligned to HIPAA and industry practices, including (without limitation):
No system is perfectly secure; we maintain an incident response program and will provide breach notifications as required by law and our BAAs.
We retain personal information as needed to provide the Services, meet HIPAA's 6-year minimum (or longer if required by law or the customer's retention policy), resolve disputes, and enforce agreements. Where feasible, we de-identify or delete data that is no longer required. If deletion is not immediately feasible (e.g., backups), we securely store and isolate it until deletion is possible.
The Services are not intended for individuals under 18. If we learn we have collected personal information from someone under 18, we will delete it consistent with law.
If your information is PHI processed under HIPAA on behalf of a clinic, your clinic's Notice of Privacy Practices governs your rights, and the requests should generally be directed to the clinic.
For non-PHI personal information subject to CCPA/CPRA, California residents may have the right to:
How to submit a request: Email privacy@authhero.com or use the in-app privacy request form (when available). We will verify your identity and respond within the timelines required by California law. You may designate an authorized agent to submit a request on your behalf, subject to verification. We will not discriminate against you for exercising your rights.
For clinic-provided data (including PHI), Auth Hero acts as a Business Associate under HIPAA and a Service Provider under CCPA/CPRA. We process such data solely to provide the Services and as permitted by our agreements and applicable law.
For Auth Hero's own operations (e.g., our marketing site contact forms), Auth Hero may act as a business in limited contexts; we still do not sell/share personal information for cross-context ads.
Our Services may include links to third-party sites or services (e.g., secure file delivery, video calls) that are not controlled by Auth Hero. Their privacy practices govern those properties. Review their policies before sharing information.
We may update this Policy from time to time. If we make material changes, we will update the "Effective Date" and provide additional notice as appropriate (e.g., in-product banner or email to admins). Your continued use of the Services after an update indicates acceptance.
If you are a patient or stakeholder invited by a clinic, you may also contact your clinic regarding PHI rights under HIPAA.
Privacy Policy v1 (current)