Website Privacy Policy

This policy covers the public marketing website only. Platform and PHI data handling is addressed separately in the Platform Privacy Policy, BAA and DPA.

Orion Software Corp ("Orion," "we," "us," "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our marketing website at orionehr.com (the "Site").

1. Information We Collect

Information you provide: When you complete a contact form, request a demo, subscribe to updates, apply to our developer program, or correspond with us, we may collect your name, email address, phone number, job title, and practice or company name, and any information you choose to include in your message.

When you submit a form: along with what you type, we record the IP address and browser user agent the submission came from, and keep that record in an internal log so we can trace and recover a lost enquiry. We use it for no other purpose.

Information collected automatically: When you visit the Site, we and our analytics and advertising providers automatically collect certain technical information, such as IP address, device and browser type, operating system, referring URLs, pages viewed, and interactions with the Site, using cookies and similar technologies (see Section 6).

The Site is a business-to-business site intended for use by adults aged 18 or over, consistent with our Terms of Service. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact us and we will delete it.

2. How We Use Information

We use personal information to:

• Respond to inquiries and provide requested information about Orion;
• Send updates, newsletters, and marketing communications (you may opt out at any time);
• Operate, maintain, analyze, and improve the Site and our marketing;
• Measure our advertising, and show ads for Orion to people who have visited the Site before;
• Detect, prevent, and address security issues and misuse;
• Comply with legal obligations and enforce our terms.

Legal bases (where applicable, e.g., for EEA/UK visitors): consent, our legitimate interests in operating and promoting our business, and compliance with legal obligations.

3. How We Share Information

We do not sell your personal information for money. We do, however, use Google Analytics and Google Ads on the Site, and the advertising tags they place send online identifiers and browsing activity to Google so we can measure our advertising and reach past visitors again with it. Under California law that counts as "sharing" for cross-context behavioral advertising, and several other state laws call it targeted advertising. We receive no money for it. Section 6 lists exactly what is set, and Section 7 explains how to opt out. We also disclose personal information to the service providers described below, for the business purposes described above.

We share personal information with:

• Service providers / subprocessors who perform functions on our behalf (see Section 4);
• Professional advisors (lawyers, accountants) as needed;
• Authorities or third parties where required by law, to enforce our rights, or in connection with a merger, acquisition, financing, or sale of assets;
• With your direction or consent.

4. Service Providers (Website)

We use the following categories of providers to operate the Site. These providers process personal information only to perform services for us and are bound by contractual confidentiality and data-protection obligations:

• Web hosting and cloud infrastructure: Railway
• Website analytics: Google Analytics
• Advertising measurement and remarketing: Google Ads. Google acts as a third party rather than a service provider for this purpose, which is why Section 3 describes it as sharing.
• Transactional email delivery: Resend
• Bot protection on our forms: Cloudflare (Turnstile)

(Vendors that process Platform/patient data, such as Stripe, Twilio, ElevenLabs, Office Ally, and Stedi, are addressed in the Platform Privacy Policy and DPA, not here.)

5. Data Security

We implement reasonable administrative, technical, and organizational safeguards designed to protect personal information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Cookies and Tracking Technologies

The Site uses Google Analytics and Google Ads. Between them they set the cookies below, some on our own domain and some on Google's. None of them are needed for the Site to work, and blocking them will not stop you using it. The list was checked against a live page load on the date at the top of this policy.

How to control them. You can block or delete cookies in your browser settings, and browsing in a private or incognito window clears them when you close it. You can opt out of Google Analytics specifically with Google's browser add-on, and you can control the advertising Google shows you in My Ad Center. What Google does with the data it collects through its own cookies is covered by Google's cookie notice. Blocking any of this will not stop you using the Site, though our forms need Turnstile to submit.

7. Your Privacy Rights

Depending on your location, you may have rights to access, correct, delete, or receive a copy of your personal information, to opt out of marketing, and (for California residents) to opt out of "sale" or "sharing" and to limit use of sensitive personal information, without discriminatory treatment for exercising these rights.

California residents (CCPA/CPRA): You may request disclosure of the categories and specific pieces of personal information we collect, the purposes, and the categories of recipients; request deletion; request correction; and opt out of sale/sharing. You may designate an authorized agent. We will verify requests before responding.

Categories of personal information (California)

Over the past 12 months we have collected the following statutory categories from Site visitors, and we disclose each of them to service providers for the business purposes described above. We have never sold a category for money. The categories marked below are shared with Google for advertising measurement and remarketing, which California treats as "sharing" for cross-context behavioral advertising. Nothing you type into a form is included: what goes to Google is the browsing and identifier data its tags collect.

We do not collect biometric information, precise geolocation, or the categories of sensitive personal information that trigger a right to limit their use.

Job applicants

If you apply through our Careers pages we collect your name, contact details, CV, any cover letter, and the information you choose to include, and we use it only to evaluate your application and communicate with you about it. Your CV and any cover letter are sent to our hiring inbox by email and are not kept in a separate applicant database. We do retain a record of the submission itself, including your name, email, the role, your location, the file names, and the IP address and browser user agent the application came from. California applicants are covered consumers, and the rights described in this section apply to that information.

How to exercise a right, and how we respond

To exercise any right, contact us at support@orionsoftware.io. We will confirm receipt within 10 business days and respond within 45 days, and we may extend that once by a further 45 days where the request is complex, telling you why before the first period ends. We will verify your identity before acting, normally by matching the details you give us against what we already hold, and we may ask for more information where a request is sensitive or the match is unclear.

An authorized agent may submit a request on your behalf. We will ask the agent for written permission signed by you, and we may contact you directly to confirm both that you gave permission and your own identity, unless the agent provides a valid power of attorney.

Appeals. If we decline a request, we will tell you why. You may appeal by replying to our decision or writing to support@orionsoftware.io with the word "Appeal" in the subject line. A person who was not involved in the original decision will review it, and we will respond in writing within 45 days with the outcome and our reasoning. If we deny the appeal, we will tell you how to contact your state attorney general to lodge a complaint.

Nevada residents

Orion Software Corp is a Nevada corporation and the Site is operated from Nevada. Nevada law (NRS 603A.340) gives Nevada consumers the right to direct a website operator not to sell certain covered information. We do not sell covered information, and we have no plans to. You may still submit a verified opt-out request to support@orionsoftware.io with "Nevada opt-out" in the subject line, and we will honor it.

Other state privacy laws

Residents of states with comprehensive privacy laws, including California, Colorado, Connecticut, Delaware, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah and Virginia, have rights to access, correct, delete and obtain a copy of their personal information, and to opt out of targeted advertising, sale, and certain profiling. We do use targeted advertising in the form of Google Ads remarketing, described in Sections 3 and 6, and you may opt out of it using the browser controls in Section 6, an opt-out preference signal, or by writing to us. We do not sell personal information for money, and we do not carry out profiling that produces legal or similarly significant effects. The process above applies to all of these requests, including the appeal.

Do Not Track and Global Privacy Control

There is no common standard for responding to browser "Do Not Track" signals, and the Site does not respond to them. Global Privacy Control is different, and because we do share personal information for advertising as described in Section 3, it has something to act on. We treat a Global Privacy Control signal as an opt-out of that sharing.

Please do not send us sensitive information

No patient information, ever. Our forms are not a route for protected health information, and we ask you never to include it. Please also avoid sending Social Security or other government identification numbers, financial account or payment card numbers, biometric data, precise geolocation, health information about yourself, or information about race or ethnicity, religion, sexual orientation, union membership, immigration status or criminal history. If you send us information of this kind we may delete it.

8. Data Retention

We retain personal information collected through the Site only as long as necessary for the purposes described here, to comply with legal obligations, resolve disputes, and enforce agreements, after which we delete or de-identify it. Our policy for marketing and lead data is to delete records for leads that have been inactive for 36 months, and you may ask us to delete yours sooner at any time using the contact details below.

9. International Visitors

The Site is operated in the United States and is intended for users in the United States. We do not target or market the Site to individuals in the European Economic Area or the United Kingdom, and we have not appointed a representative there. If you access the Site from outside the U.S., you understand your information will be processed in the U.S.

10. Third-Party Links

The Site links to third-party websites and services we do not control, including our social profiles and sources we cite. This policy does not apply to them. Their handling of your information is governed by their own policies, and we encourage you to read them.

11. Changes to This Policy

We may update this Policy from time to time. Changes are effective when posted, and we will update the "Last Updated" date. Material changes may be communicated by additional notice.

12. Contact Us