Privacy Policy
Privacy Policy
Privacy Policy
Updated: July 19, 2026.
Updated: July 19, 2026.
On this page
On this page
Jump directly to a section.
Jump directly to a section.
OVERVIEW & SCOPE
ENTERPRISE & SECURITY
HEALTH INFORMATION
RIGHTS & LEGAL
Scope and who we are
Scope and who we are
Auteva Inc., doing business as Auteva Health (“Auteva,” “Auteva Health,” “we,” “us,” or “our”), operates autevahealth.com and develops health-information technology, including PatientLayer, Health Context Protocol (HCP), and related services. This Privacy Policy applies to the public website, public inquiry channels, and any Auteva consumer product or service that links to this policy. Product-specific notices, consent screens, enterprise agreements, business associate agreements, data processing agreements, and our Consumer Health Data Privacy Policy may supplement this policy and control for the activity they specifically govern.
Auteva Inc., doing business as Auteva Health (“Auteva,” “Auteva Health,” “we,” “us,” or “our”), operates autevahealth.com and develops health-information technology, including PatientLayer, Health Context Protocol (HCP), and related services. This Privacy Policy applies to the public website, public inquiry channels, and any Auteva consumer product or service that links to this policy. Product-specific notices, consent screens, enterprise agreements, business associate agreements, data processing agreements, and our Consumer Health Data Privacy Policy may supplement this policy and control for the activity they specifically govern.
Our legal role depends on the relationship and data flow. Auteva may act as an independent business or controller for some information, as a processor or service provider for information handled on another organization’s instructions, or as a HIPAA business associate when the facts and applicable agreement place Auteva in that role. Nothing in this policy is intended to expand or reduce rights or obligations established by a signed agreement or applicable law.
Our legal role depends on the relationship and data flow. Auteva may act as an independent business or controller for some information, as a processor or service provider for information handled on another organization’s instructions, or as a HIPAA business associate when the facts and applicable agreement place Auteva in that role. Nothing in this policy is intended to expand or reduce rights or obligations established by a signed agreement or applicable law.
Information we collect
Information we collect
Depending on how you interact with Auteva, we may collect identifiers and contact details; account and profile information; professional or organization information; inquiry and support communications; internet, device, application, and security information; approximate location derived from IP address; and records of permissions, consents, requests, and account activity. If you use an Auteva consumer health product, additional information may include health records and documents, health-history details, record-source and provenance information, appointment and care-continuity information, user questions and prompts, generated explanations or summaries, connected-source information, identity-verification results, and information showing that a representative, guardian, caregiver, or other person is authorized to act where that feature is supported. The exact categories depend on the features you use and the sources you choose to connect.
Depending on how you interact with Auteva, we may collect identifiers and contact details; account and profile information; professional or organization information; inquiry and support communications; internet, device, application, and security information; approximate location derived from IP address; and records of permissions, consents, requests, and account activity. If you use an Auteva consumer health product, additional information may include health records and documents, health-history details, record-source and provenance information, appointment and care-continuity information, user questions and prompts, generated explanations or summaries, connected-source information, identity-verification results, and information showing that a representative, guardian, caregiver, or other person is authorized to act where that feature is supported. The exact categories depend on the features you use and the sources you choose to connect.
Sources and automatic collection
Sources and automatic collection
We collect information directly from you when you submit a form, email us, request a demo, communicate with our team, or provide information during a business introduction. We may receive professional contact information from another person or organization that introduces you to us. Website systems and service providers may collect technical information automatically when you browse the site. We may also receive information from hosting, communications, security, anti-spam, or analytics providers used to operate the website. We do not intentionally purchase medical records or consumer health profiles for use through this public website.
We collect information directly from you when you submit a form, email us, request a demo, communicate with our team, or provide information during a business introduction. We may receive professional contact information from another person or organization that introduces you to us. Website systems and service providers may collect technical information automatically when you browse the site. We may also receive information from hosting, communications, security, anti-spam, or analytics providers used to operate the website. We do not intentionally purchase medical records or consumer health profiles for use through this public website.
How we use information
How we use information
We may use personal information to operate, maintain, and secure the website; respond to inquiries; schedule and manage requested conversations; evaluate partnership, customer, employment, or vendor opportunities; route messages to the appropriate team; maintain business records; prevent fraud, spam, abuse, or security incidents; troubleshoot and improve website performance; comply with law, legal process, contracts, audits, and regulatory obligations; establish, exercise, or defend legal rights; and communicate about an interaction you requested. If you separately opt in to updates or marketing communications, we may send them subject to applicable law and your ability to unsubscribe. A general website inquiry is not consent to access medical records, exchange clinical data, or enroll you in a healthcare service.
We may use personal information to operate, maintain, and secure the website; respond to inquiries; schedule and manage requested conversations; evaluate partnership, customer, employment, or vendor opportunities; route messages to the appropriate team; maintain business records; prevent fraud, spam, abuse, or security incidents; troubleshoot and improve website performance; comply with law, legal process, contracts, audits, and regulatory obligations; establish, exercise, or defend legal rights; and communicate about an interaction you requested. If you separately opt in to updates or marketing communications, we may send them subject to applicable law and your ability to unsubscribe. A general website inquiry is not consent to access medical records, exchange clinical data, or enroll you in a healthcare service.
Business contacts, applicants, and workforce-related data
Business contacts, applicants, and workforce-related data
Auteva may process professional and business information relating to prospective or current customers, partners, vendors, advisers, job applicants, contractors, and workforce members. This information may include contact details, professional history, organization and role information, communications, scheduling information, application materials, interview notes, security or access information, and records needed to evaluate or manage a business or employment relationship.
Auteva may process professional and business information relating to prospective or current customers, partners, vendors, advisers, job applicants, contractors, and workforce members. This information may include contact details, professional history, organization and role information, communications, scheduling information, application materials, interview notes, security or access information, and records needed to evaluate or manage a business or employment relationship.
This information is used for legitimate business administration, recruiting, due diligence, contracting, security, compliance, communications, and relationship management. Health information collected through an employee benefit plan, occupational-health program, customer healthcare workflow, or other regulated context is governed according to the legal framework applicable to that context rather than solely by this general business-contact section.
This information is used for legitimate business administration, recruiting, due diligence, contracting, security, compliance, communications, and relationship management. Health information collected through an employee benefit plan, occupational-health program, customer healthcare workflow, or other regulated context is governed according to the legal framework applicable to that context rather than solely by this general business-contact section.
Health information, HIPAA, and consumer health data
Health information, HIPAA, and consumer health data
Health information can be governed by different legal frameworks depending on who holds it, why it is processed, and the relationship among the parties. HIPAA does not apply to every company or every item of health information. When Auteva acts as a business associate to a HIPAA covered entity, protected health information (“PHI”) is handled under the applicable business associate agreement and the HIPAA Privacy, Security, and Breach Notification Rules. When health information is outside HIPAA, other laws may apply, including the FTC Health Breach Notification Rule, state consumer-health privacy laws, comprehensive state privacy laws, and other federal or state requirements.
Health information can be governed by different legal frameworks depending on who holds it, why it is processed, and the relationship among the parties. HIPAA does not apply to every company or every item of health information. When Auteva acts as a business associate to a HIPAA covered entity, protected health information (“PHI”) is handled under the applicable business associate agreement and the HIPAA Privacy, Security, and Breach Notification Rules. When health information is outside HIPAA, other laws may apply, including the FTC Health Breach Notification Rule, state consumer-health privacy laws, comprehensive state privacy laws, and other federal or state requirements.
Auteva does not treat a technical connection, account relationship, or ability to receive information as unrestricted permission to collect, use, or disclose health information. The applicable service, user request, participating organization, legal authority, contractual terms, and required consent or authorization determine what information may be processed.
Auteva does not treat a technical connection, account relationship, or ability to receive information as unrestricted permission to collect, use, or disclose health information. The applicable service, user request, participating organization, legal authority, contractual terms, and required consent or authorization determine what information may be processed.
Protected health information and business associate relationships
Protected health information and business associate relationships
When Auteva creates, receives, maintains, or transmits PHI on behalf of a HIPAA covered entity or another business associate in a manner that makes Auteva a business associate, the applicable business associate agreement defines the permitted and required uses and disclosures of PHI. Auteva does not use or disclose PHI for purposes outside those permitted by the agreement or required by law.
When Auteva creates, receives, maintains, or transmits PHI on behalf of a HIPAA covered entity or another business associate in a manner that makes Auteva a business associate, the applicable business associate agreement defines the permitted and required uses and disclosures of PHI. Auteva does not use or disclose PHI for purposes outside those permitted by the agreement or required by law.
Where applicable, Auteva maintains safeguards for electronic PHI and requires subcontractors that create, receive, maintain, or transmit PHI on Auteva’s behalf to accept appropriate downstream restrictions and safeguards. The applicable agreement may also address security incidents and breach reporting, access to records, amendment support, accounting information, regulatory access, return or destruction of PHI, and other obligations required by HIPAA.
Where applicable, Auteva maintains safeguards for electronic PHI and requires subcontractors that create, receive, maintain, or transmit PHI on Auteva’s behalf to accept appropriate downstream restrictions and safeguards. The applicable agreement may also address security incidents and breach reporting, access to records, amendment support, accounting information, regulatory access, return or destruction of PHI, and other obligations required by HIPAA.
An enterprise customer remains responsible for the obligations assigned to it by law and contract, including determining its authority to disclose PHI to Auteva, providing legally required notices, and responding to individual requests when the customer is the entity responsible for those requests. Auteva supports customer obligations to the extent required by law and the applicable agreement.
An enterprise customer remains responsible for the obligations assigned to it by law and contract, including determining its authority to disclose PHI to Auteva, providing legally required notices, and responding to individual requests when the customer is the entity responsible for those requests. Auteva supports customer obligations to the extent required by law and the applicable agreement.
Specially protected and sensitive health information
Specially protected and sensitive health information
Some health information may be subject to protections that are more restrictive than general health-information rules. Depending on the information and the parties involved, this may include substance use disorder records governed by 42 CFR Part 2, certain mental-health information, genetic information, reproductive-health information, HIV or communicable-disease information, records concerning minors, or other categories protected by federal or state law.
Some health information may be subject to protections that are more restrictive than general health-information rules. Depending on the information and the parties involved, this may include substance use disorder records governed by 42 CFR Part 2, certain mental-health information, genetic information, reproductive-health information, HIV or communicable-disease information, records concerning minors, or other categories protected by federal or state law.
When a heightened rule applies to information processed through an Auteva service, the additional restriction, consent, authorization, redisclosure limitation, or other legal requirement applies to that information. Auteva’s services do not eliminate or override legal restrictions that attach to information because of its source, category, or permitted purpose.
When a heightened rule applies to information processed through an Auteva service, the additional restriction, consent, authorization, redisclosure limitation, or other legal requirement applies to that information. Auteva’s services do not eliminate or override legal restrictions that attach to information because of its source, category, or permitted purpose.
PatientLayer and product health data
PatientLayer and product health data
Depending on the service and features used, Auteva may process health information and related personal information that a user provides, requests, imports, retrieves, receives from an authorized source, or creates while using the service. This may include health-record information, care-related information, information about healthcare services, user-provided documents or content, account and preference information, information needed to support authorized access or sharing, and contextual or technical information associated with those records. The specific information processed depends on the feature used, the source selected, and the user’s instructions. We use this information only for disclosed purposes, to provide and secure the requested service, and as otherwise permitted or required by applicable law or agreement.
Depending on the service and features used, Auteva may process health information and related personal information that a user provides, requests, imports, retrieves, receives from an authorized source, or creates while using the service. This may include health-record information, care-related information, information about healthcare services, user-provided documents or content, account and preference information, information needed to support authorized access or sharing, and contextual or technical information associated with those records. The specific information processed depends on the feature used, the source selected, and the user’s instructions. We use this information only for disclosed purposes, to provide and secure the requested service, and as otherwise permitted or required by applicable law or agreement.
Sources of health and product data
Sources of health and product data
Health and product information may come directly from the user; from records or other materials the user chooses to provide; from healthcare organizations, systems, services, or other sources that the user connects or that are otherwise authorized to provide information; from a person authorized to act for the user where supported; and from service providers that help us operate, secure, verify, or support the service. A technical connection alone does not give Auteva unrestricted access to information. Access depends on the applicable service, user request, authorization or other legal basis, participating source, and law.
Health and product information may come directly from the user; from records or other materials the user chooses to provide; from healthcare organizations, systems, services, or other sources that the user connects or that are otherwise authorized to provide information; from a person authorized to act for the user where supported; and from service providers that help us operate, secure, verify, or support the service. A technical connection alone does not give Auteva unrestricted access to information. Access depends on the applicable service, user request, authorization or other legal basis, participating source, and law.
Identity, authority, consent, and representatives
Identity, authority, consent, and representatives
Certain Auteva services may require us to confirm identity, account control, consent, authorization, or a person’s authority to act for someone else. Where representative access is supported, we may process information reasonably necessary to determine whether the person has appropriate authority and the scope of that authority. Permission to access or share particular information does not automatically extend to unrelated information or purposes. We may limit or suspend access when authority cannot be confirmed, has changed, has expired, has been withdrawn, or must otherwise be restricted by law or agreement.
Certain Auteva services may require us to confirm identity, account control, consent, authorization, or a person’s authority to act for someone else. Where representative access is supported, we may process information reasonably necessary to determine whether the person has appropriate authority and the scope of that authority. Permission to access or share particular information does not automatically extend to unrelated information or purposes. We may limit or suspend access when authority cannot be confirmed, has changed, has expired, has been withdrawn, or must otherwise be restricted by law or agreement.
AI-assisted features
AI-assisted features
Some Auteva services may use automated or AI-assisted functionality to help organize information, answer questions, summarize or explain information, or support other user-requested features. When a feature requires personal or health information, that information may be processed by Auteva and contracted service providers only as reasonably necessary for the permitted purpose, subject to applicable law and agreement. Automated outputs may be incomplete or incorrect and are not a substitute for professional medical judgment. If Auteva were to use consumer health data for a materially different purpose, we would provide any additional notice, consent, or other choice required by applicable law.
Some Auteva services may use automated or AI-assisted functionality to help organize information, answer questions, summarize or explain information, or support other user-requested features. When a feature requires personal or health information, that information may be processed by Auteva and contracted service providers only as reasonably necessary for the permitted purpose, subject to applicable law and agreement. Automated outputs may be incomplete or incorrect and are not a substitute for professional medical judgment. If Auteva were to use consumer health data for a materially different purpose, we would provide any additional notice, consent, or other choice required by applicable law.
We do not sell health information
We do not sell health information
Auteva does not sell health information or consumer health data, including in exchange for monetary or other valuable consideration, and we do not condition access to our services on a person agreeing to such a sale. We do not use or disclose health information for cross-context behavioral advertising. We may disclose information to processors, healthcare organizations, authorized recipients, or other parties when reasonably necessary to provide a requested service, carry out a user’s direction, comply with law, or satisfy another permitted purpose described in this policy. Those permitted disclosures are not a sale by Auteva. If Auteva were ever to introduce a practice that applicable law treats as a sale of consumer health data, we would first update the applicable notice and obtain any separate authorization required by law.
Auteva does not sell health information or consumer health data, including in exchange for monetary or other valuable consideration, and we do not condition access to our services on a person agreeing to such a sale. We do not use or disclose health information for cross-context behavioral advertising. We may disclose information to processors, healthcare organizations, authorized recipients, or other parties when reasonably necessary to provide a requested service, carry out a user’s direction, comply with law, or satisfy another permitted purpose described in this policy. Those permitted disclosures are not a sale by Auteva. If Auteva were ever to introduce a practice that applicable law treats as a sale of consumer health data, we would first update the applicable notice and obtain any separate authorization required by law.
Enterprise customers and regulated processing
Enterprise customers and regulated processing
When Auteva processes information for a healthcare organization, employer, health plan, technology partner, or other enterprise customer, the applicable written agreement may define Auteva’s role, permitted processing, security obligations, retention, incident responsibilities, audit rights, and handling of regulated information. In some relationships Auteva may act on the customer’s documented instructions rather than independently determining the purposes of processing. Where HIPAA applies, a business associate agreement or other required arrangement governs protected health information. Where another privacy or data-protection law applies, a data processing agreement, service agreement, consent, authorization, or similar instrument may supplement this policy. Enterprise customers remain responsible for the obligations assigned to them by law and contract, including determining their own authority to provide information to Auteva and responding to rights requests when they are the legally responsible entity.
When Auteva processes information for a healthcare organization, employer, health plan, technology partner, or other enterprise customer, the applicable written agreement may define Auteva’s role, permitted processing, security obligations, retention, incident responsibilities, audit rights, and handling of regulated information. In some relationships Auteva may act on the customer’s documented instructions rather than independently determining the purposes of processing. Where HIPAA applies, a business associate agreement or other required arrangement governs protected health information. Where another privacy or data-protection law applies, a data processing agreement, service agreement, consent, authorization, or similar instrument may supplement this policy. Enterprise customers remain responsible for the obligations assigned to them by law and contract, including determining their own authority to provide information to Auteva and responding to rights requests when they are the legally responsible entity.
Enterprise customer instructions and rights support
Enterprise customer instructions and rights support
When Auteva processes personal information on behalf of an enterprise customer, Auteva may process that information on the customer’s documented instructions and for the purposes established by the applicable agreement. The customer is responsible for determining the lawful basis, authority, and instructions it provides to Auteva unless the agreement or law assigns a particular responsibility to Auteva.
When Auteva processes personal information on behalf of an enterprise customer, Auteva may process that information on the customer’s documented instructions and for the purposes established by the applicable agreement. The customer is responsible for determining the lawful basis, authority, and instructions it provides to Auteva unless the agreement or law assigns a particular responsibility to Auteva.
Where required by law or contract, Auteva assists enterprise customers with requests involving access, correction, amendment, deletion, restriction, portability, or an accounting or history of disclosures. The exact process depends on the legal role of each party. A request submitted directly to Auteva may therefore be handled by Auteva, referred to the responsible enterprise customer, or coordinated with that customer as appropriate.
Where required by law or contract, Auteva assists enterprise customers with requests involving access, correction, amendment, deletion, restriction, portability, or an accounting or history of disclosures. The exact process depends on the legal role of each party. A request submitted directly to Auteva may therefore be handled by Auteva, referred to the responsible enterprise customer, or coordinated with that customer as appropriate.
Enterprise commitments concerning data location, retention, deletion, incident response, subprocessor notice, audit support, service levels, or other negotiated obligations are governed by the applicable written agreement rather than by generalized statements on the public website.
Enterprise commitments concerning data location, retention, deletion, incident response, subprocessor notice, audit support, service levels, or other negotiated obligations are governed by the applicable written agreement rather than by generalized statements on the public website.
Service providers, processors, and contractual controls
Service providers, processors, and contractual controls
Auteva may use service providers, subprocessors, contractors, and professional advisers to support hosting, storage, security, identity or account verification, communications, customer support, analytics where enabled, and other functions necessary to operate a service. We select providers based on the function they perform and the sensitivity of the information they may handle.
Auteva may use service providers, subprocessors, contractors, and professional advisers to support hosting, storage, security, identity or account verification, communications, customer support, analytics where enabled, and other functions necessary to operate a service. We select providers based on the function they perform and the sensitivity of the information they may handle.
Where a provider processes personal information on Auteva’s behalf, Auteva requires contractual protections appropriate to the service and applicable law. These may include purpose limitations, confidentiality, security obligations, restrictions on independent use, incident reporting, assistance with legally required requests, return or deletion requirements, and appropriate downstream obligations. A processor’s access to information does not give it permission to use Auteva health information for unrelated advertising, data-broker, or independent commercial purposes.
Where a provider processes personal information on Auteva’s behalf, Auteva requires contractual protections appropriate to the service and applicable law. These may include purpose limitations, confidentiality, security obligations, restrictions on independent use, incident reporting, assistance with legally required requests, return or deletion requirements, and appropriate downstream obligations. A processor’s access to information does not give it permission to use Auteva health information for unrelated advertising, data-broker, or independent commercial purposes.
Data minimization, access, and purpose limitation
Data minimization, access, and purpose limitation
Auteva seeks to limit the collection, access, use, and disclosure of personal and health information to what is reasonably necessary for the permitted purpose, the requested feature, or another lawful basis. Where a minimum-necessary standard applies, Auteva applies that standard according to its legal role and the governing agreement.
Auteva seeks to limit the collection, access, use, and disclosure of personal and health information to what is reasonably necessary for the permitted purpose, the requested feature, or another lawful basis. Where a minimum-necessary standard applies, Auteva applies that standard according to its legal role and the governing agreement.
Access to sensitive information is limited according to legitimate business need, role, authorization, contractual obligation, and applicable law. Auteva may use technical and organizational controls to restrict access, record activity, manage permissions, and prevent information from being used for purposes that are not authorized or otherwise permitted.
Access to sensitive information is limited according to legitimate business need, role, authorization, contractual obligation, and applicable law. Auteva may use technical and organizational controls to restrict access, record activity, manage permissions, and prevent information from being used for purposes that are not authorized or otherwise permitted.
How we disclose information
How we disclose information
We may disclose personal information to service providers and contractors that help us host, secure, support, communicate, verify, analyze, or provide requested functionality. For connected health services, information may also be disclosed to a healthcare organization, authorized source, recipient, or connected service when the disclosure is directed by the user, reasonably necessary to provide the requested service, or otherwise permitted or required by law. We may also disclose information to professional advisers, regulators, courts, authorities, or parties to a qualifying business transaction where legally permitted. We do not authorize service providers to use personal information for unrelated purposes, and we do not sell consumer health data for monetary consideration.
We may disclose personal information to service providers and contractors that help us host, secure, support, communicate, verify, analyze, or provide requested functionality. For connected health services, information may also be disclosed to a healthcare organization, authorized source, recipient, or connected service when the disclosure is directed by the user, reasonably necessary to provide the requested service, or otherwise permitted or required by law. We may also disclose information to professional advisers, regulators, courts, authorities, or parties to a qualifying business transaction where legally permitted. We do not authorize service providers to use personal information for unrelated purposes, and we do not sell consumer health data for monetary consideration.
Legal process and governmental requests
Legal process and governmental requests
Auteva may disclose information when required or permitted by applicable law, regulation, court order, subpoena, warrant, or other valid legal process. We assess the nature and scope of a request and disclose information only to the extent reasonably necessary or legally required for the request or another permitted legal purpose.
Auteva may disclose information when required or permitted by applicable law, regulation, court order, subpoena, warrant, or other valid legal process. We assess the nature and scope of a request and disclose information only to the extent reasonably necessary or legally required for the request or another permitted legal purpose.
Where legally permitted and appropriate, Auteva may notify an affected customer or individual of a governmental or legal request so that the responsible party can respond or seek protection. We may also preserve information when required by law, litigation hold, regulatory inquiry, security investigation, or another lawful preservation obligation.
Where legally permitted and appropriate, Auteva may notify an affected customer or individual of a governmental or legal request so that the responsible party can respond or seek protection. We may also preserve information when required by law, litigation hold, regulatory inquiry, security investigation, or another lawful preservation obligation.
Cookies, analytics, and preference signals
Cookies, analytics, and preference signals
The website may use cookies, local storage, server logs, and similar technologies that are necessary for security, forms, preferences, and basic site operation. Where analytics or other optional technologies are enabled, we use them only as permitted by applicable notice, consent, and opt-out rules. You can control many cookies through your browser, although blocking necessary technologies may affect site functionality. Where applicable law requires recognition of a valid universal opt-out mechanism, including Global Privacy Control, we will process the signal as required for the relevant activity. Browser “Do Not Track” signals do not have a uniform legal meaning and may not be treated as an opt-out unless applicable law requires it.
The website may use cookies, local storage, server logs, and similar technologies that are necessary for security, forms, preferences, and basic site operation. Where analytics or other optional technologies are enabled, we use them only as permitted by applicable notice, consent, and opt-out rules. You can control many cookies through your browser, although blocking necessary technologies may affect site functionality. Where applicable law requires recognition of a valid universal opt-out mechanism, including Global Privacy Control, we will process the signal as required for the relevant activity. Browser “Do Not Track” signals do not have a uniform legal meaning and may not be treated as an opt-out unless applicable law requires it.
Retention and secure disposal
Retention and secure disposal
Auteva retains information only for as long as reasonably necessary for the purpose for which it was collected and for applicable legal, contractual, security, dispute-resolution, audit, backup, and recordkeeping requirements. Retention therefore varies by information category, legal role, customer relationship, feature, and source.
Auteva retains information only for as long as reasonably necessary for the purpose for which it was collected and for applicable legal, contractual, security, dispute-resolution, audit, backup, and recordkeeping requirements. Retention therefore varies by information category, legal role, customer relationship, feature, and source.
Account and service information may be retained while an account or relationship is active and for a reasonable period afterward. Health information and user-provided content are retained according to the applicable service, user instructions, signed agreement, legal obligations, and available deletion rights. Consent, authorization, representative-authority, audit, support, security, and transaction records may be retained for periods necessary to demonstrate compliance, investigate incidents, support enterprise customers, or protect users and systems.
Account and service information may be retained while an account or relationship is active and for a reasonable period afterward. Health information and user-provided content are retained according to the applicable service, user instructions, signed agreement, legal obligations, and available deletion rights. Consent, authorization, representative-authority, audit, support, security, and transaction records may be retained for periods necessary to demonstrate compliance, investigate incidents, support enterprise customers, or protect users and systems.
When information is no longer needed, Auteva deletes, de-identifies, anonymizes, or otherwise disposes of it in a manner appropriate to the information and applicable requirements. Backups and archived systems may follow separate deletion cycles where permitted by law.
When information is no longer needed, Auteva deletes, de-identifies, anonymizes, or otherwise disposes of it in a manner appropriate to the information and applicable requirements. Backups and archived systems may follow separate deletion cycles where permitted by law.
Security and incident response
Security and incident response
Auteva maintains an information-security program designed to protect the confidentiality, integrity, and availability of personal information based on its sensitivity, the service involved, and applicable legal or contractual requirements. Safeguards may include risk management, access controls, authentication, encryption where appropriate, logging and monitoring, secure development and change-management practices, vulnerability management, personnel controls, vendor oversight, backup and recovery measures, and incident-response procedures.
Auteva maintains an information-security program designed to protect the confidentiality, integrity, and availability of personal information based on its sensitivity, the service involved, and applicable legal or contractual requirements. Safeguards may include risk management, access controls, authentication, encryption where appropriate, logging and monitoring, secure development and change-management practices, vulnerability management, personnel controls, vendor oversight, backup and recovery measures, and incident-response procedures.
Security measures are reviewed and adjusted over time as systems, threats, legal requirements, and business operations change. No organization can guarantee that unauthorized access, loss, or misuse will never occur, and this policy does not disclose Auteva’s nonpublic security architecture, control configurations, monitoring methods, credentials, or other information that could reduce the security of Auteva or its customers.
Security measures are reviewed and adjusted over time as systems, threats, legal requirements, and business operations change. No organization can guarantee that unauthorized access, loss, or misuse will never occur, and this policy does not disclose Auteva’s nonpublic security architecture, control configurations, monitoring methods, credentials, or other information that could reduce the security of Auteva or its customers.
Auteva investigates suspected security incidents and takes reasonable steps to contain, remediate, document, and evaluate them. When a breach-notification law or enterprise agreement applies, Auteva provides notices or cooperation to affected individuals, customers, regulators, or others as required by the applicable rule or agreement. Any certification, attestation, or compliance statement applies only to the systems, scope, period, and conditions identified in the corresponding report or certificate.
Auteva investigates suspected security incidents and takes reasonable steps to contain, remediate, document, and evaluate them. When a breach-notification law or enterprise agreement applies, Auteva provides notices or cooperation to affected individuals, customers, regulators, or others as required by the applicable rule or agreement. Any certification, attestation, or compliance statement applies only to the systems, scope, period, and conditions identified in the corresponding report or certificate.
Your privacy rights and choices
Your privacy rights and choices
Depending on where you live and which law applies, you may have the right to request access to personal information; obtain information about categories, sources, purposes, and recipients; correct inaccurate information; request deletion; obtain a portable copy; opt out of qualifying sales, sharing, targeted advertising, or certain profiling; limit certain uses of sensitive personal information; withdraw consent where processing is based on consent; object to or restrict certain processing; designate an authorized agent; appeal certain denials; and receive equal service without unlawful discrimination for exercising privacy rights. Rights are subject to legal exceptions and do not apply identically in every jurisdiction or to every category of information. To submit a request or appeal, email legal@autevahealth.com. We may take reasonable steps to verify identity and authority before responding.
Depending on where you live and which law applies, you may have the right to request access to personal information; obtain information about categories, sources, purposes, and recipients; correct inaccurate information; request deletion; obtain a portable copy; opt out of qualifying sales, sharing, targeted advertising, or certain profiling; limit certain uses of sensitive personal information; withdraw consent where processing is based on consent; object to or restrict certain processing; designate an authorized agent; appeal certain denials; and receive equal service without unlawful discrimination for exercising privacy rights. Rights are subject to legal exceptions and do not apply identically in every jurisdiction or to every category of information. To submit a request or appeal, email legal@autevahealth.com. We may take reasonable steps to verify identity and authority before responding.
California and other U.S. state privacy notices
California and other U.S. state privacy notices
If a U.S. state privacy law applies to Auteva and to your information, this section supplements the rest of this policy. Categories we may collect through the public website include identifiers and contact information, professional or employment-related information, internet or network activity, approximate geolocation derived from IP address, inquiry and commercial information, communications, and limited inferences about the nature or status of an inquiry. Sources include you, people or organizations that introduce you to us, and website or security technologies. We use these categories for the business purposes described above and may disclose them to service providers, contractors, professional advisers, and authorities as described above. We do not intentionally collect sensitive medical information through public website forms. We do not use information submitted through public forms to build cross-context advertising profiles. If an activity is treated by applicable law as a sale, sharing, targeted advertising, or another opt-out activity, we will provide the notice and opt-out method required by that law. Covered residents may exercise applicable access, correction, deletion, portability, opt-out, limitation, appeal, and non-discrimination rights by contacting legal@autevahealth.com. Where required, we honor recognized universal opt-out signals.
If a U.S. state privacy law applies to Auteva and to your information, this section supplements the rest of this policy. Categories we may collect through the public website include identifiers and contact information, professional or employment-related information, internet or network activity, approximate geolocation derived from IP address, inquiry and commercial information, communications, and limited inferences about the nature or status of an inquiry. Sources include you, people or organizations that introduce you to us, and website or security technologies. We use these categories for the business purposes described above and may disclose them to service providers, contractors, professional advisers, and authorities as described above. We do not intentionally collect sensitive medical information through public website forms. We do not use information submitted through public forms to build cross-context advertising profiles. If an activity is treated by applicable law as a sale, sharing, targeted advertising, or another opt-out activity, we will provide the notice and opt-out method required by that law. Covered residents may exercise applicable access, correction, deletion, portability, opt-out, limitation, appeal, and non-discrimination rights by contacting legal@autevahealth.com. Where required, we honor recognized universal opt-out signals.
International processing and transfers
International processing and transfers
Auteva is based in the United States. Personal information may be processed in the United States and in other locations where Auteva or its authorized service providers operate, subject to applicable law, contractual commitments, and any service-specific data-location requirements.
Auteva is based in the United States. Personal information may be processed in the United States and in other locations where Auteva or its authorized service providers operate, subject to applicable law, contractual commitments, and any service-specific data-location requirements.
Where the GDPR, UK GDPR, or another international data-protection law applies, Auteva relies on an appropriate legal basis for processing and uses a lawful transfer mechanism or other required safeguard for covered international transfers. Enterprise data-location, localization, or transfer commitments, if any, are governed by the applicable written agreement.
Where the GDPR, UK GDPR, or another international data-protection law applies, Auteva relies on an appropriate legal basis for processing and uses a lawful transfer mechanism or other required safeguard for covered international transfers. Enterprise data-location, localization, or transfer commitments, if any, are governed by the applicable written agreement.
Children
Children
The public website and inquiry forms are directed to adults and professional visitors. We do not knowingly collect personal information from children under 13 through public forms, and the website is not designed as a child-directed service. If a future Auteva product is intended for minors or processes a minor’s health information, that product will require appropriate age, authority, parental or guardian, consent, and privacy controls as applicable. If you believe a child has provided personal information through the public website, contact legal@autevahealth.com so we can review and take appropriate action.
The public website and inquiry forms are directed to adults and professional visitors. We do not knowingly collect personal information from children under 13 through public forms, and the website is not designed as a child-directed service. If a future Auteva product is intended for minors or processes a minor’s health information, that product will require appropriate age, authority, parental or guardian, consent, and privacy controls as applicable. If you believe a child has provided personal information through the public website, contact legal@autevahealth.com so we can review and take appropriate action.
Changes to this policy
Changes to this policy
We may update this Privacy Policy as our website, services, legal obligations, or information practices change. The “Last updated” date at the top identifies the version currently in effect. If a change materially affects how personal information is used or if applicable law requires additional notice or consent, we will provide that notice in an appropriate manner. A product-specific privacy notice, consumer health data policy, business associate agreement, data processing agreement, or other signed agreement may supplement or replace portions of this website policy for the activity it governs.
We may update this Privacy Policy as our website, services, legal obligations, or information practices change. The “Last updated” date at the top identifies the version currently in effect. If a change materially affects how personal information is used or if applicable law requires additional notice or consent, we will provide that notice in an appropriate manner. A product-specific privacy notice, consumer health data policy, business associate agreement, data processing agreement, or other signed agreement may supplement or replace portions of this website policy for the activity it governs.
Contact
Contact
Legal Entity
Auteva Inc. DBA Auteva Health
Privacy & Data Rights
Support
Mailing Address
415 Mission Street
San Francisco, CA 94105
United States
Please do not send medical records, government identification, passwords, payment information, or other sensitive health information by email. If a secure or jurisdiction-specific channel is required, we’ll provide it.