Revora Health privacy policy

This privacy policy explains how Revora Health, Inc. ("Revora," "we," "us," or "our") collects, uses, shares, and protects information when you use the Revora Health iOS app, the Revora provider dashboard, or the revora.health website (together, the "Services").

This launch of the app and dashboard is currently available only to patients and clinicians located in Kentucky, accessed through iOS. If you are located outside Kentucky, please do not use the app at this time. The website itself is available to everyone.

Revora Health is not a medical device and has not received FDA clearance. Nothing in the Services is intended to diagnose, treat, cure, or prevent any disease or condition. The Services are designed to support the home exercise program prescribed by your treating physical therapist and never to replace their clinical judgment. Always follow your treating clinician’s instructions, and contact them or seek emergency care if you experience pain, injury, or any symptom that concerns you.

Clara, the in-app companion, is an artificial intelligence feature. You are interacting with an AI, and never with a licensed clinician. Clara does not diagnose conditions or prescribe changes to your exercise program. Any concerning signal Clara identifies is escalated to your treating physical therapist for review. Clara does not make clinical decisions on your behalf.

This section describes the revora.health marketing site only. The website is separate from the app and the provider dashboard, which are covered in the sections below. Nothing the website collects is health information, and none of it is joined to an app account, to your clinic's records, or to anything you have told a clinician.

We built the site to collect as little as possible:

• We measure website traffic using privacy-preserving analytics from Vercel, the company that hosts this site. The measurement request goes to revora.health rather than to an outside analytics network. It records the page you opened, the site you arrived from, an approximate location no more precise than a city, and your browser and device type. It sets no cookies and stores nothing on your device. Visits are counted using a temporary value derived from the request and discarded within a day, so the measurement cannot identify you and cannot follow you to any other website.
• We run no advertising, no tracking cookies, and no session recording of any kind.
• The page written for patients, /for-patients, makes no requests to any third party. Apart from loading the page itself, the only request it makes is the traffic measurement described above, which goes to revora.health.
• The demo booking page, /book-a-demo, embeds a scheduler hosted by Google Calendar. If you use it, Google processes what you enter there under Google’s own privacy policy.
• The referral and contact actions on this site compose an email in your own mail app. The site itself stores nothing you type.
• Our hosting provider keeps ordinary server request logs needed to operate and secure the site.

Account and identity information: name, contact information, and login credentials used to access the app. We use one-time email codes rather than passwords.

Health and treatment information: the home exercise program assigned by your treating clinician, your self-reported symptoms and progress, adherence and engagement data (for example, whether and when you completed an assigned session), and messages exchanged with Clara.

Movement and engagement data: the app may use your device’s camera to help guide you through exercises. In the current version of the app this computer-vision feature is disabled and is not active or collecting movement data. If and when this feature is enabled in a future version, this policy will be updated first, and separate consent will be requested before the feature is turned on. When active, this feature is designed for patient engagement and motivation rather than clinical-grade measurement; your treating clinician’s own assessment remains the clinical record.

Usage and device information: app version, device type, general diagnostic and crash data, and similar technical information needed to operate and secure the Services.

Communications: messages you send to us for support, and records of your consent to telehealth services.

We do not currently collect payment information through the app. Billing for your care is handled directly by your treating clinic.

We use the information described above to:

• Operate the app and dashboard, including displaying your assigned exercises and progress to you and to your treating clinician
• Support your treating clinician’s delivery of physical therapy services, including flagging patients who may need attention sooner
• Provide Clara’s coaching and check-in features
• Maintain the security, integrity, and reliability of the Services
• Meet our legal and regulatory obligations, including Kentucky’s telehealth informed-consent requirements
• Communicate with you about the Services, including support requests

We do not use your health information for advertising, and we do not sell personal data.

With your treating clinic: your treating physical therapist and their staff can see the information needed to provide your care, including your adherence data and progress. Revora provides software and monitoring services to your treating clinic; your clinic is responsible for your medical record and for its own HIPAA notice practices. Revora acts as a Business Associate to your clinic under a signed agreement governing how we may use and protect your health information on their behalf.

With service providers who help us operate the Services: we use a small number of vendors to run the app and dashboard. Each is contractually restricted to using data only to provide their service to us, and is bound by a Business Associate Agreement where they may handle protected health information: Convex (backend data storage and authentication), Azure OpenAI (powers Clara’s conversational features), and Resend (delivers one-time login codes by email).

We do not pass your name, date of birth, or other direct identifiers to the AI models that power Clara. Clara operates on de-identified session data, and your identity is re-attached only within our secured backend.

For legal reasons: we may disclose information if required by law, court order, or to protect the safety of a patient or others.

We do not sell personal data or health data, to anyone, for any purpose.

Kentucky law (KRS 327.200 and 201 KAR 22:160) requires your treating physical therapist to obtain and document your informed consent before delivering care through telehealth, including confirming your identity, providing you a non-electronic way to reach them (including for emergencies), and reviewing with you the risks of using electronic communication for your care. You will be asked to review and acknowledge these items the first time you access the app, and your acknowledgment is recorded and retained as part of your treatment record. This consent is documented as part of your treating clinician’s regulatory obligation under Kentucky law; Revora provides the technical infrastructure that captures and retains it on your clinician’s behalf.

If you are a Kentucky resident, and depending on whether Revora meets the applicable thresholds under the Kentucky Consumer Data Protection Act (KCDPA), you may have the right to:

• Confirm whether we are processing your personal data
• Access the personal data we hold about you
• Correct inaccuracies in your personal data
• Delete your personal data
• Obtain a portable copy of your personal data
• Withdraw consent to processing of sensitive data, such as health information, at any time

Much of the health information we hold about you is protected health information under HIPAA, which is handled under HIPAA’s own access and amendment rules rather than the KCDPA. Non-health account information, such as your contact details, is handled under the rights listed above.

To exercise any of these rights, contact us at surya@revora.health. We will respond within 45 days, or let you know if we need an additional 45 days for a complex request. If you disagree with our response, you may appeal by writing to the same address, and if your appeal is denied, you may contact the Kentucky Attorney General’s Office of Data Privacy.

We do not use your data for targeted advertising, and there is nothing to opt out of in that respect.

We use administrative, technical, and physical safeguards designed to protect your information, including encryption, minimum-necessary access controls, and short-lived authentication tokens. No system is completely secure, and we cannot guarantee absolute security of information transmitted to or from the Services.

We retain your information for as long as needed to provide the Services, support your treating clinician’s medical record obligations, and meet our legal and regulatory retention requirements.

The Services are intended for use by adult patients. We do not knowingly collect information from children under 18, and our current patient population does not include minors.

We will post any changes to this policy at this URL and update the effective date above. If a change is material, we will provide additional notice, such as an in-app notification, before it takes effect.

Revora Health, Inc., 727 Sansome St, San Francisco, CA. surya@revora.health