Revora Health

Privacy Policy

Revora Health Privacy Policy

Effective Date: July 24, 2026

This Privacy Policy explains how Revora Health, Inc. ("Revora," "we," "us," or "our") collects, uses, shares, and protects information when you use the Revora Health iOS app, the Revora provider dashboard, or the revora.health website (together, the "Services").

This launch of the Services is currently available only to patients and clinicians located in Kentucky, accessed only through iOS. If you are located outside Kentucky, please do not use the Services at this time.

1. Not a Substitute for Medical Advice

Revora Health is not a medical device and has not received FDA clearance. Nothing in the Services is intended to diagnose, treat, cure, or prevent any disease or condition. The Services are designed to support the home exercise program prescribed by your treating physical therapist, not to replace their clinical judgment. Always follow your treating clinician's instructions, and contact them or seek emergency care if you experience pain, injury, or any symptom that concerns you.

Clara, the in-app companion, is an artificial intelligence feature. You are interacting with an AI, not a licensed clinician. Clara does not diagnose conditions or prescribe changes to your exercise program. Any concerning signal Clara identifies is escalated to your treating physical therapist for review — Clara does not make clinical decisions on your behalf.

2. Information We Collect

Account and identity information: name, contact information, and login credentials used to access the app (we use one-time email codes rather than passwords).

Health and treatment information: the home exercise program assigned to you by your treating clinician, your self-reported symptoms and progress, adherence and engagement data (for example, whether and when you completed an assigned session), and messages exchanged with Clara.

Movement/engagement data: the app may use your device's camera to help guide you through exercises. In the current version of the app, this computer-vision feature is disabled and is not active or collecting movement data. If and when this feature is enabled in a future version, this policy will be updated first, and separate consent will be requested before the feature is turned on. This feature, when active, is designed for patient engagement and motivation, and is not a clinical-grade measurement tool — your treating clinician's own assessment remains the clinical record.

Usage and device information: app version, device type, general diagnostic and crash data, and similar technical information needed to operate and secure the Services.

Communications: messages you send to us for support, and records of your consent to telehealth services (see Section 5).

We do not currently collect payment information through the app; billing for your care is handled directly by your treating clinic.

3. How We Use Information

We use the information described above to:

  • Operate the app and dashboard, including displaying your assigned exercises and progress to you and to your treating clinician

  • Support your treating clinician's delivery of physical therapy services, including flagging patients who may need attention sooner (our "Action-Priority" view for clinicians)

  • Provide Clara's coaching and check-in features

  • Maintain the security, integrity, and reliability of the Services

  • Meet our legal and regulatory obligations, including Kentucky's telehealth informed-consent requirements

  • Communicate with you about the Services, including support requests

We do not use your health information for advertising, and we do not sell personal data.

4. How Information Is Shared

With your treating clinic: Your treating physical therapist and their staff can see the information needed to provide your care, including your adherence data and progress.

With service providers who help us operate the Services: We use a small number of vendors to run the app and dashboard. Each of these vendors is contractually restricted to using data only to provide their service to us, and is bound by a Business Associate Agreement where they may handle protected health information:

VendorRoleConvexBackend data storage, authenticationAzure OpenAIPowers Clara's conversational featuresResendDelivers one-time login codes by email

We do not pass your name, date of birth, or other direct identifiers to the AI models that power Clara — Clara operates on de-identified session data, and your identity is re-attached only within our secured backend.

With your treating clinic as our customer: Revora provides software and monitoring services to your treating clinic. Your clinic is responsible for your medical record and for its own HIPAA notice practices. Revora acts as a Business Associate to your clinic under a signed agreement governing how we may use and protect your health information on their behalf.

For legal reasons: We may disclose information if required by law, court order, or to protect the safety of a patient or others.

We do not sell personal data or health data, to anyone, for any purpose.

5. Kentucky Telehealth Informed Consent

Kentucky law (KRS 327.200 and 201 KAR 22:160) requires your treating physical therapist to obtain and document your informed consent before delivering care through telehealth, including confirming your identity, providing you a non-electronic way to reach them (including for emergencies), and reviewing with you the risks of using electronic communication for your care. You will be asked to review and acknowledge these items the first time you access the app, and your acknowledgment is recorded and retained as part of your treatment record. This consent is documented as part of your treating clinician's regulatory obligation under Kentucky law; Revora provides the technical infrastructure that captures and retains it on your clinician's behalf.

6. Your Privacy Rights

If you are a Kentucky resident, and depending on whether Revora meets the applicable thresholds under the Kentucky Consumer Data Protection Act (KCDPA), you may have the right to:

  • Confirm whether we are processing your personal data

  • Access the personal data we hold about you

  • Correct inaccuracies in your personal data

  • Delete your personal data

  • Obtain a portable copy of your personal data

  • Withdraw consent to processing of sensitive data (such as health information) at any time

Note that much of the health information we hold about you is protected health information under HIPAA, which is handled under HIPAA's own access and amendment rules rather than the KCDPA. Non-health account information (such as your contact details) is handled under the rights listed above.

To exercise any of these rights, contact us at surya@revora.health. We will respond within 45 days, or let you know if we need an additional 45 days for a complex request. If you disagree with our response, you may appeal by writing to the same address, and if your appeal is denied, you may contact the Kentucky Attorney General's Office of Data Privacy.

We do not use your data for targeted advertising and there is nothing to opt out of in that respect.

7. Data Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption, minimum-necessary access controls, and short-lived authentication tokens. No system is completely secure, and we cannot guarantee absolute security of information transmitted to or from the Services.

8. Data Retention

We retain your information for as long as needed to provide the Services, support your treating clinician's medical record obligations, and meet our legal and regulatory retention requirements.

9. Children's Privacy

The Services are intended for use by adult patients. We do not knowingly collect information from children under 18, and our current patient population does not include minors.

10. Changes to This Policy

We will post any changes to this policy at this URL and update the effective date above. If a change is material, we will provide additional notice, such as an in-app notification, before it takes effect.

11. Contact Us

Questions about this policy or your data can be directed to:

Revora Health, Inc. 727 Sansome St, San Francisco, CA surya@revora.health