Privacy Policy

A Note on This Policy & HIPAA

Elva Health Technologies (“Elva,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we handle your Personal Information—that is, information we collect from you when you visit our website or when you sign up for and manage your Elva account.

This Privacy Policy does not apply to Protected Health Information (“PHI”).

When Elva provides Services to a dental practice (our “Customer”), we are acting as a “Business Associate” under HIPAA. All PHI processed through our Services (e.g., patient names, treatment data, communications) is governed strictly by the Business Associate Agreement (BAA) between Elva and that Customer, not by this Privacy Policy.

If you are a patient of one of our Customers, please review your dental provider’s “Notice of Privacy Practices” to understand how your PHI is used and protected.

1. Information We Collect

We collect “Personal Information” about our Customers and website visitors in the following ways:

a) Information You Provide to Us:

• Marketing & Demo Information: When you request a demo, subscribe to our newsletter, or contact us, you provide your name, email address, phone number, and practice name.
• Account & Profile Information: When you become a Customer and create an account, we collect your name, email, phone number, username, password, and practice billing information.
• Payment Information: We use third-party payment processors (e.g., Stripe) to collect and manage your payment card information. We do not store this information on our servers.

b) Information We Collect Automatically:

• Usage Data: When you use the Services, we automatically collect information about your interactions, such as features used, clicks, time spent, and other user activity.
• Log and Device Data: We collect log files and device information when you access our Site or Services, including your IP address, browser type, operating system, device identifiers, and pages visited.
• Cookies and Trackers: We use cookies and similar tracking technologies to analyze trends, administer the Site, track users’ movements, and gather demographic information. You can control the use of cookies at the individual browser level.

2. How We Use Your Information

We use the Personal Information we collect for the following purposes:

• To Provide and Maintain the Services: To set up your account, provide the Services, process payments, and provide customer support.
• To Communicate with You: To send you service-related and administrative emails (e.g., billing, maintenance, security alerts) and, with your consent, to send you marketing communications (you may opt-out at any time).
• To Secure and Protect Our Services: To monitor for and prevent fraudulent, illegal, or harmful activity and to ensure the security of our Site and Services.
• To Improve Our Services and AI: To analyze usage data and trends to understand how our Services are used, to make improvements, and to train our artificial intelligence models. For clarity: We will only use Customer Data (including PHI) for AI training in a de-identified and aggregated form, as permitted by our BAA and HIPAA. We do not use your identifiable data to train models for other customers.

3. How We Share Your Information

We do not sell, rent, or trade your Personal Information. We may share your information in the following limited circumstances:

• With Service Providers (Sub-processors): We may share your information with third-party vendors who perform services on our behalf, such as cloud hosting (e.g., AWS), payment processing (e.g., Stripe), and communications (e.g., Twilio for SMS). We have agreements in place requiring them to protect your information.
• With Third-Party Integrations: When you choose to connect your Elva account to a third-party service (e.g., your Practice Management System), we will share your data with that service as instructed by you.
• For Legal Reasons: We may disclose your information if required by law, subpoena, or other legal process, or if we have a good-faith belief that such disclosure is necessary to protect our rights, your safety, or the safety of others.
• During a Business Transfer: If we are involved in a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction.

Text messaging: All of the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. See Section 4 for details.

4. Text Messaging (SMS)

This section covers text messages Elva sends on its own behalf, for example to dental practices that speak with us. Messages a dental practice sends to its own patients through the Elva platform are governed by that practice’s policies and our Business Associate Agreement, not by this section.

We send text messages only to people who ask for them. For example, if you speak with Elva by phone and ask us to text you a link to book a demo, or a confirmation of a demo you booked, we will send those messages to the mobile number you give us. By providing your mobile number and agreeing to receive texts, you consent to receive these messages from Elva Health Technologies. Consent to receive text messages is not a condition of any purchase.

• Message frequency: Varies based on your requests.
• Costs: Message and data rates may apply.
• Opting out: Reply STOP to any message at any time. We will confirm your opt-out and will not text you again unless you opt in again.
• Help: Reply HELP, or email us at [email protected].
• Delivery: Mobile carriers are not liable for delayed or undelivered messages.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors in support services, such as the provider that delivers our text messages, is permitted solely to send the messages you requested. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

5. Data Security

We implement and maintain reasonable administrative, technical, and physical safeguards to protect the Personal Information we control. We use measures such as encryption, access controls, and secure data storage. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee its absolute security.

6. Data Retention

We will retain your Personal Information for as long as your account is active or as needed to provide you with the Services. We will also retain and use your information as necessary to comply with our legal obligations (including HIPAA retention requirements), resolve disputes, and enforce our agreements.

7. Your Data Privacy Rights

Depending on your location, you may have certain rights regarding your Personal Information:

• Opt-Out of Marketing: You may opt-out of receiving marketing emails from us at any time by clicking the “unsubscribe” link in the email.
• Access, Correction, and Deletion: You may have the right to request access to, correct, or delete your Personal Information. Please submit such requests to [email protected].
• Notice to California Residents (CCPA): If you are a California resident, you have the right to know what personal information we collect, use, and disclose. You also have the right to request deletion of your information. We do not “sell” or “share” your personal information as defined by the CCPA. To exercise your rights, please contact us.

8. Children’s Privacy

Our Site and Services are not intended for or directed at children under the age of 13 (or 16 in certain jurisdictions). We do not knowingly collect Personal Information from children. If we learn that we have, we will take steps to delete such information promptly.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the “Last Updated” date. We encourage you to review this policy periodically.

10. Contact Us

If you have any questions or concerns about this Privacy Policy or our privacy practices, please contact us at:

Elva Health Technologies
169 Madison Avenue, New York, NY 10016
Email: [email protected]
Attn: Privacy Officer