Privacy Policy
Last updated: July 14, 2026 ยท Version 2026-07-14.2
Privacy at a glance
We do not sell personal or health information, use protected health information for advertising, or use the OzEHR or OzOnCall mobile apps for cross-app tracking.
Information is used to deliver, secure, support, and improve the services selected by you and your care organization.
You can manage communications, request access or correction, review disclosures, and initiate account closure through the Services or our Privacy Choices page.
1. Scope and organization
This Privacy Policy explains how ozehr LLC ("ozehr," "we," "our," or "us") handles information when you use the ozehr electronic health record platform, OzEHR patient portal and mobile app, OzOnCall provider app, related communications, and our public websites (collectively, the "Services"). It applies to information handled by ozehr in operating the Services. It does not replace the Notice of Privacy Practices or privacy notice issued by your healthcare provider, college, university, health center, or other care organization (your "Care Organization").
ozehr is operated by ozehr LLC, a Nevada limited liability company. Public business mailing address: 732 S 6th St, Ste N, Las Vegas, NV 89101.
2. Our role and your Care Organization's role
Your Care Organization controls your clinical record and decides how it is used for treatment, payment, healthcare operations, student-health administration, and other authorized purposes. When ozehr handles protected health information ("PHI") for a Care Organization subject to HIPAA, ozehr generally acts as its Business Associate and uses or discloses PHI only as permitted by the applicable agreement or law. Your Care Organization remains responsible for its Notice of Privacy Practices and for responding to individual-rights requests unless it has authorized ozehr to assist.
For public-website visitors, prospective customers, and direct business contacts, ozehr may act as the organization responsible for the contact, device, and inquiry information submitted directly to us.
3. Information we collect
Name, preferred name, date of birth, account identifiers, email address, phone number, mailing address, emergency contacts, authorized representatives, and communication preferences.
Medical history, conditions, diagnoses, allergies, medications, immunizations, laboratory and imaging results, appointments, clinical notes, care plans, forms, questionnaires, messages, demographic information, disability information, sex, gender identity, sexual orientation, race, ethnicity, and other information you or your Care Organization places in the record.
Coverage and guarantor information, insurance-card images, claims, statements, account balances, payments, and billing history. When a hosted payment processor collects payment-card or bank details directly, ozehr does not receive the complete card or bank-account number.
Secure messages, attachments, photos or videos you choose to provide where enabled, record-sharing instructions, support requests, survey answers, pre-visit information, Ask Toto questions and responses, and other content submitted through the Services.
Device and app identifiers, push-notification tokens, app version, operating system, browser type, IP address, authentication and audit events, feature interactions, timestamps, and crash or performance information when enabled. OzEHR does not request precise or approximate device-location permission.
Demo requests, institution and role information, correspondence, and limited website analytics, cookies, or similar technologies used to secure and operate the public site and understand aggregate use.
We receive information from you, your Care Organization and its authorized workforce, authorized representatives, devices you use, and integrations or service providers selected by your Care Organization.
4. How we use information
Authenticate users; display and maintain records; schedule visits; support telehealth; process forms, refills, results, messages, record requests, billing, and insurance workflows; and send requested communications.
Present relevant care plans, reminders, explanations, accessibility preferences, and user-selected settings.
Prevent fraud and unauthorized access, enforce permissions, maintain audit trails, investigate incidents, troubleshoot failures, and preserve availability and integrity.
Provide customer support, monitor reliability, evaluate feature performance, conduct quality assurance, and improve workflows using the minimum information reasonably necessary.
Comply with applicable law, respond to lawful process, support Care Organization obligations, preserve records subject to retention or legal-hold requirements, and enforce agreements.
5. Mobile permissions and on-device security
OzEHR requests camera or photo-library access only when you choose an image-upload feature, such as uploading an insurance card, immunization record, or profile photo. OzOnCall requests microphone access only when an authorized user starts an Oz Scribe workflow after required encounter consent is recorded. Push-notification permission is used for care, workflow, and account notifications. Face ID, Touch ID, fingerprint, or device-lock verification occurs through the device platform; ozehr receives the authentication result, not your biometric template. You can change operating-system permissions in device settings, although disabling a permission may disable the associated feature.
6. AI-assisted features
Some Services use artificial intelligence to assist with tasks such as patient questions, explanations, information extraction, transcription, and draft clinical documentation. These features may process the health information, messages, forms, audio, or other content necessary to provide the requested function. AI outputs may be incomplete or incorrect and are presented for patient or clinician review; they do not replace professional medical judgment and are not intended for emergencies.
ozehr does not permit PHI to be used by ozehr or its service providers for advertising or for an independent purpose unrelated to providing the contracted Services. Service providers that process PHI are subject to contractual confidentiality, security, use, and disclosure restrictions, including Business Associate terms where required.
7. When we disclose information
We disclose information only as reasonably necessary and permitted for the following purposes:
Clinicians, staff, facilities, representatives, recipients, and other participants authorized for treatment, payment, operations, student-health administration, or a disclosure you request.
Cloud hosting, database, storage, notification, communications, identity, telehealth, payment, laboratory, pharmacy, support, security, AI, and transcription providers that perform services for ozehr or the Care Organization under applicable contractual restrictions.
When required by law or lawful process; to prevent serious harm, fraud, or abuse; to protect rights and systems; or as part of a merger, financing, acquisition, or transfer, subject to applicable health-information restrictions.
When you authorize record sharing, designate a representative, connect an integration, or otherwise direct a disclosure.
8. No sale, advertising, or mobile tracking
We do not sell personal information or PHI. We do not share mobile information, SMS consent, or opt-in data with third parties or affiliates for their marketing or promotional purposes. We do not use PHI for targeted advertising, and neither the OzEHR nor OzOnCall mobile app uses advertising SDKs or data for tracking you across apps or websites owned by other companies.
9. SMS, email, and push communications
Care-related and account communications are sent according to your selections and your Care Organization's configuration. SMS consent is optional and is not a condition of care or account creation. Reply STOP to opt out of SMS and HELP for assistance, update your preferences in the portal or app, or contact your Care Organization. Message frequency varies; message and data rates may apply. Essential security or service notices may still be delivered through an available channel as permitted by law.
10. Retention, account closure, and deletion
Care Organizations determine retention of medical and education records under applicable federal, state, institutional, accreditation, contractual, litigation-hold, and professional requirements. HIPAA does not itself establish a general medical-record retention period. ozehr retains information for the period directed by the Care Organization and as needed to operate and secure the Services, maintain required audit and compliance evidence, resolve disputes, and satisfy applicable law and contracts.
You may initiate account closure from OzEHR's Privacy & Data screen or through our Privacy Choices page. Closing an app or portal account disables access and revokes active sessions, but it does not automatically erase the medical or education record controlled by your Care Organization. After identity and authority are verified, information that is not required for care, security, audit, legal, or record-retention purposes will be deleted, de-identified, or scheduled for deletion where applicable. Residual encrypted backups are protected and age out under backup-retention schedules unless preservation is legally required.
OzOnCall workforce accounts are provisioned by Care Organization administrators rather than created in the mobile app. An authenticated provider may initiate account deactivation from OzOnCall's Privacy & Data screen. The request creates an auditable, organization-scoped review task for a separate authorized administrator. Approved deactivation disables future access and revokes active sessions, but does not erase signed clinical documentation, audit evidence, legal-hold material, or other records the Care Organization or ozehr must retain.
11. Your choices and rights
Depending on your relationship with the Care Organization and applicable law, you may have rights to access or obtain a copy of information, request a correction, request restrictions or confidential communications, obtain an accounting of certain disclosures, withdraw an authorization, manage communications, close an account, request deletion of eligible information, appeal a decision, or submit a complaint. Your Care Organization generally handles rights concerning the clinical or education record, and ozehr assists as required by contract or law.
We may verify identity and authority before fulfilling a request. We will not discriminate against you for exercising an applicable privacy right. Instructions are available on our Privacy Choices page.
12. HIPAA, FERPA, and state privacy laws
HIPAA applies to covered healthcare providers and their Business Associates. Certain student health or counseling records maintained by an educational institution may instead be education records governed by FERPA, and state medical, mental-health, consumer-health, biometric, or general privacy laws may also apply. Your Care Organization's notices explain which rules apply to its records. References to rights in this policy are subject to those laws, permitted exceptions, and ozehr's role for the relevant information.
13. Minors and authorized representatives
Access for a minor, parent, guardian, dependent, proxy, or other authorized representative is controlled by the Care Organization and applicable consent, confidentiality, and access laws. A representative may see only the information and functions authorized for that relationship. If you believe representative access is inaccurate or unsafe, contact your Care Organization promptly.
14. Security
We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit and at rest, access controls, multi-factor authentication, secure credential storage, audit logging, monitoring, backups, testing, and incident-response procedures. No system can guarantee absolute security. Protect your credentials, use device security, sign out of shared devices, and notify your Care Organization or ozehr if you suspect unauthorized access.
15. Processing location
The Services are intended primarily for United States organizations and users. Information may be processed in the United States by ozehr and authorized service providers. If a Care Organization enables a service that processes information elsewhere, it is responsible with ozehr for applying the contractual and legal safeguards required for that use.
16. Changes to this policy
We may update this policy to reflect changes in the Services, law, or our practices. We will post the revised policy and update its date and version. When a change is material, we will provide additional notice through the Services, email, or the Care Organization when required.
17. Contact and complaints
For questions, privacy requests, or complaints, use the in-app Privacy & Data screen, visit Privacy Choices, contact your Care Organization, or contact ozehr LLC at contact@ozehr.com or 775-239-9991. Mail may be sent to 732 S 6th St, Ste N, Las Vegas, NV 89101. If HIPAA applies, you may also submit a complaint to the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate for a good-faith complaint.