Privacy Policy

Auvora, Inc.
Effective date: October 7, 2026

This Privacy Policy explains how Auvora, Inc. ("Auvora", "we", "us") collects, uses and protects information through our website at auvoralabs.com and our clinic software platform, including the text messages and emails sent through it.

1. Who we are and whose data this covers

Auvora provides software to aesthetics clinics ("Clinics"). Clinics use Auvora to manage patient records, prepare skin-analysis reports and send patients notifications about their reports and appointments.

• Patients. When a Clinic uses Auvora, the Clinic decides what patient information is collected and why. For that information, Auvora acts as the Clinic's service provider and, where HIPAA applies, as its business associate. Patient health information is handled under our agreement with the Clinic and the Clinic's own Notice of Privacy Practices. If you are a patient, contact your Clinic about your records; we will help the Clinic respond.
• Clinic staff and website visitors. For information about Clinic staff users and visitors to auvoralabs.com, Auvora is responsible, and this policy applies directly.

2. Information we collect

• Provided by Clinics about patients: name, contact details (such as mobile phone number and email address), appointment information, consent records, and clinical information the Clinic records, including skin-analysis images and reports.
• Clinic staff accounts: name, work email, role, sign-in and security information.
• Automatically: basic technical information such as IP address, browser type and access times, used to operate and secure the service.

3. How we use information

We use information only to provide the service on the Clinic's behalf. That includes storing records, generating reports, delivering notifications the patient has consented to, securing the platform, and meeting legal obligations. We do not sell personal information, and we do not use patient information for our own marketing.

4. Text messages (SMS)

Patients may choose to receive text messages from Auvora about their skin reports and appointments at their Clinic, through the Auvora Patient Notifications program.

• Consent. Messages are sent only to patients who have opted in to Auvora Patient Notifications. Consent is recorded in the patient's record with its date, and our system checks for it before every message.
• What we collect. Your mobile number, your consent record, and records of the messages sent to you (time, delivery status and similar).
• No sharing for marketing. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except the service providers and carriers needed to deliver the messages.
• Opting out. Reply STOP at any time to stop receiving messages, or HELP for help. See our SMS Terms.
• Message content. Messages begin with "Auvora:", name the patient's Clinic, and include a secure link. They do not include health information.

5. Email

Clinics may send patients emails through Auvora, such as a notification that a report is ready, only where the patient has consented. These emails contain the Clinic's name and a secure link, not health information.

6. How we share information

We share information only:

• with the Clinic that provided it;
• with service providers that host or deliver the service for us, under contracts that protect the information (for example cloud hosting, and email and SMS delivery providers), including business associate agreements where HIPAA applies;
• when required by law, or to protect the rights, safety and security of patients, Clinics, Auvora or others.

We do not sell or rent personal information.

7. Security

We protect information with safeguards designed for health data. These include encryption in transit and at rest, per-field encryption of direct identifiers, access controls that keep each Clinic's data separate, audit logging, and signed, expiring links for reports. No system is perfectly secure, but we work to protect your information and will notify Clinics of security incidents as the law and our agreements require.

8. Retention

We keep information for as long as the Clinic's account is active, or as needed to meet legal, clinical-record and contractual obligations. After that it is deleted or de-identified.

9. Your choices and rights

• Patients: to access, correct or delete your information, contact your Clinic. To stop text messages, reply STOP.
• Clinic staff and website visitors: contact us at the address below. Depending on where you live, you may have additional rights under state privacy laws.

10. Children

Auvora is not directed to children under 13, and we do not knowingly collect their information outside a Clinic's patient records.

11. Changes

We may update this policy. We will post the new version here with a new effective date, and notify Clinics of material changes.

12. Contact us

Auvora, Inc.
37535 Bay Crest Road
Newark, CA 94560
Email: support@auvoralabs.com