Privacy Policy

1. Who we are

OrganAlert provides software that helps lung transplant programs evaluate organ-donor offers. We act as a Business Associate to the transplant centers (Covered Entities) that use our platform. This policy describes our general privacy practices; our handling of protected health information (PHI) is governed by the Business Associate Agreement with each center.

2. The two kinds of data we handle

• Protected health information (PHI): donor and recipient clinical data uploaded or generated in the platform. We process PHI only on documented instructions from the Covered Entity, for the purpose of providing the service.
• Account & usage data: names and work email addresses of authorized users, organization details, authentication events, and audit metadata used to operate and secure the service.

3. How we use information

We use PHI solely to provide the evaluation service to the Covered Entity. We use account and usage data to authenticate users, enforce access controls, maintain security and audit records, provide support, and improve reliability. We do not sell personal information, and we do not use PHI to train machine-learning models.

4. Sharing & subprocessors

We share information only with infrastructure and AI subprocessors that are bound by appropriate agreements (including BAAs where PHI is involved). See our current subprocessor list.

5. Text message (SMS) communications

With your consent, OrganAlert may send text messages to the mobile number you provide: account notifications that a donor evaluation report is ready for your review (containing a sign-in link only) and a one-time code to verify your number. Messages never contain protected health information or patient or donor identifiers. Message frequency varies with clinical activity. Message and data rates may apply. Reply HELP for help or STOP to opt out at any time; you can also turn texts off in your account settings. Consent to receive texts is not a condition of using OrganAlert.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except with our messaging service provider solely to deliver the messages you have requested.

6. Security

We encrypt PHI at rest and in transit, enforce least-privilege access and tenant isolation, and maintain an append-only audit log. See our security overview for details.

7. Retention

We retain PHI for as long as instructed by the Covered Entity and as required to provide the service, and we return or destroy it on termination per the BAA. Account and audit records are retained for the periods required by our compliance obligations.

8. Your rights

Requests by individuals to access, amend, or account for disclosures of their PHI are directed to the Covered Entity (the transplant center), which we support as their Business Associate.

9. Contact

Privacy questions: privacy@organalert.com.